com php-src: Fix bug #67326 fileinfo: cdf_r ead_short_sector insufficient boundary check: ext /fileinfo/libmagic/cdf.c

Commit: 52de149ebccfea4b63da2e5bacf6f60a1bfc7ffb Author: Remi Collet <remi@php.net> Tue, 3 Jun 2014 11:05:00 +0200 Committer: Stanislav Malyshev <stas@php.net> Fri, 18 Jul 2014 16:13:07 -0700 Parents: 2326401fc197cb88141561d3d51eccd7ac59fede Branches: PHP-5.3 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=52de149ebccfea4b63da2e5bacf6f60a1bfc7ffb Log: Fix bug #67326 fileinfo: cdf_read_short_sector insufficient boundary check Upstream fix https://github.com/file/file/commit/6d209c1c489457397a5763bca4b28e43aac90391.patch Only revelant part applied Bugs: https://bugs.php.net/67326 Changed paths: M ext/fileinfo/libmagic/cdf.c Diff: diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index ea67966..f57753a 100644 --- a/ext/fileinfo/libmagic/cdf.c +++ b/ext/fileinfo/libmagic/cdf.c @@ -365,10 +365,10 @@ cdf_read_short_sector(const cdf_stream_t *sst, void *buf, size_t offs, size_t ss = CDF_SHORT_SEC_SIZE(h); size_t pos = CDF_SHORT_SEC_POS(h, id); assert(ss == len); - if (pos > CDF_SEC_SIZE(h) * sst->sst_len) { + if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) { DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %" SIZE_T_FORMAT "u\n", - pos, CDF_SEC_SIZE(h) * sst->sst_len)); + pos + len, CDF_SEC_SIZE(h) * sst->sst_len)); return -1; } (void)memcpy(((char *)buf) + offs,