com php-src: Bug #67412 fileinfo: cdf_count_chain insufficient boundary check: ext/fileinfo/libmagic/cdf .c

Commit: 892def5f12716c9f926588bd2190acd6ea99a3a0 Author: Remi Collet <remi@php.net> Tue, 10 Jun 2014 14:22:04 +0200 Committer: Stanislav Malyshev <stas@php.net> Fri, 18 Jul 2014 16:20:19 -0700 Parents: 8d1d03850955855b86f949b43e532ef8c22c1cc3 Branches: PHP-5.3 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=892def5f12716c9f926588bd2190acd6ea99a3a0 Log: Bug #67412 fileinfo: cdf_count_chain insufficient boundary check Upstream: https://github.com/file/file/commit/40bade80cbe2af1d0b2cd0420cebd5d5905a2382 Bugs: https://bugs.php.net/67412 Changed paths: M ext/fileinfo/libmagic/cdf.c Diff: diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index 5dce5ce..3b6f488 100644 --- a/ext/fileinfo/libmagic/cdf..c +++ b/ext/fileinfo/libmagic/cdf.c @@ -470,7 +470,8 @@ size_t cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size) { size_t i, j; - cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size); + cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size) + / sizeof(maxsector)); DPRINTF(("Chain:")); for (j = i = 0; sid >= 0; i++, j++) { @@ -480,8 +481,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size) errno = EFTYPE; return (size_t)-1; } - if (sid > maxsector) { - DPRINTF(("Sector %d > %d\n", sid, maxsector)); + if (sid >= maxsector) { + DPRINTF(("Sector %d >= %d\n", sid, maxsector)); errno = EFTYPE; return (size_t)-1; }