com php-src: Fix bug #68283: fileinfo: out-of-bounds read in elf note headers: ext/fileinfo/libmagic/readelf.c

Commit: 1803228597e82218a8c105e67975bc50e6f5bf0d Author: Remi Collet <remi@php.net> Wed, 22 Oct 2014 15:37:04 +0200 Parents: 287c91c1f060dc85a8bdb51488c50db8614448b7 Branches: PHP-5.4 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=1803228597e82218a8c105e67975bc50e6f5bf0d Log: Fix bug #68283: fileinfo: out-of-bounds read in elf note headers Upstream commit https://github.com/file/file/commit/39c7ac1106be844a5296d3eb5971946cc09ffda0 CVE -2014-3710 Bugs: https://bugs.php.net/68283 Changed paths: M ext/fileinfo/libmagic/readelf.c Diff: diff --git a/ext/fileinfo/libmagic/readelf.c b/ext/fileinfo/libmagic/readelf.c index 1c3845f..bb6f70f 100644 --- a/ext/fileinfo/libmagic/readelf.c +++ b/ext/fileinfo/libmagic/readelf.c @@ -372,6 +372,13 @@ donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size, uint32_t namesz, descsz; unsigned char *nbuf = CAST(unsigned char *, vbuf); + if (xnh_sizeof + offset > size) { + /* + * We're out of note headers. + */ + return xnh_sizeof + offset; + } + (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof); offset += xnh_sizeof;