com php-src: Fix bug #67716 - Segfault in cdf.c: ext/fileinfo/libmagic/cdf.c

Commit: cba5120407fbd0735b9aac5ede2fd02bdfab46a9 Author: Remi Collet <rcollet@redhat.com> Thu, 14 Aug 2014 17:19:03 -0700 Committer: Julien Pauli <jpauli@php.net> Tue, 19 Aug 2014 15:01:19 +0200 Parents: 0c3302fb217e7dcc08bbd0e2df89ed80c500a069 Branches: PHP-5.5.16 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=cba5120407fbd0735b9aac5ede2fd02bdfab46a9 Log: Fix bug #67716 - Segfault in cdf.c Bugs: https://bugs.php.net/67716 Changed paths: M ext/fileinfo/libmagic/cdf.c Diff: diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index 429f3b9..2c0a2d9 100644 --- a/ext/fileinfo/libmagic/cdf.c +++ b/ext/fileinfo/libmagic/cdf.c @@ -820,7 +820,7 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, q = (const uint8_t *)(const void *) ((const char *)(const void *)p + ofs - 2 * sizeof(uint32_t)); - if (q > e) { + if (q < p || q > e) { DPRINTF(("Ran of the end %p > %p\n", q, e)); goto out; }