com php-src: Fixed Bug #67411 fileinfo: cdf_check_st ream_offset insufficient boundary check: ext/filein fo/libmagic/cdf.c

Commit: 8d1d03850955855b86f949b43e532ef8c22c1cc3 Author: Remi Collet <remi@php.net> Tue, 10 Jun 2014 14:13:14 +0200 Committer: Stanislav Malyshev <stas@php.net> Fri, 18 Jul 2014 16:19:30 -0700 Parents: 6bd5a06894fa2f8c1b53bf92fb809d911b740e84 Branches: PHP-5.3 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=8d1d03850955855b86f949b43e532ef8c22c1cc3 Log: Fixed Bug #67411 fileinfo: cdf_check_stream_offset insufficient boundary check Upstream: https://github.com/file/file/commit/36fadd29849b8087af9f4586f89dbf74ea45be67 Conflicts: ext/fileinfo/libmagic/cdf.c Bugs: https://bugs.php.net/67411 Changed paths: M ext/fileinfo/libmagic/cdf.c Diff: diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index f57753a..5dce5ce 100644 --- a/ext/fileinfo/libmagic/cdf.c +++ b/ext/fileinfo/libmagic/cdf.c @@ -277,13 +277,15 @@ cdf_check_stream_offset(const cdf_stream_t *sst, const cdf_header_t *h, { const char *b = (const char *)sst->sst_tab; const char *e = ((const char *)p) + tail; + size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ? + CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h); (void)&line; - if (e >= b && (size_t)(e - b) < CDF_SEC_SIZE(h) * sst->sst_len) + if (e >= b && (size_t)(e - b) <= ss * sst->sst_len) return 0; DPRINTF(("%d: offset begin %p end %p %" SIZE_T_FORMAT "u" " >= %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %" SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b), - CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len)); + ss * sst->sst_len, ss, sst->sst_len)); errno = EFTYPE; return -1; }