com php-src: Fixed bug #71527 Buffer over-write in finfo_open with malformed magic file: ext/fileinfo/libmagic/f uncs.c
ext/fileinfo/tests/bug68996.phpt ext/f ileinfo/tests/bug71527.magic ext/fileinfo/tests/b ug71527.phpt

Commit: 7522335b994595f8ef28b078b4ce440eca225422 Author: Anatol Belski <ab@php.net> Mon, 28 Mar 2016 00:45:19 +0200 Committer: Ferenc Kovacs <tyrael@php.net> Wed, 30 Mar 2016 23:00:33 +0200 Parents: 43416cfc065b9d1d7d35db7ad42534759d01e77a Branches: PHP-5.6.20 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=7522335b994595f8ef28b078b4ce440eca225422 Log: Fixed bug #71527 Buffer over-write in finfo_open with malformed magic file The actual fix is applying the upstream patch from https://github.com/file/file/commit/6713ca45e7757297381f4b4cdb9cf5e624a9ad36 Bugs: https://bugs.php.net/71527 Changed paths: M ext/fileinfo/libmagic/funcs.c M ext/fileinfo/tests/bug68996.phpt A ext/fileinfo/tests/bug71527.magic A ext/fileinfo/tests/bug71527.phpt Diff: diff --git a/ext/fileinfo/libmagic/funcs..c b/ext/fileinfo/libmagic/funcs.c index bd6d3d5..e3249c1 100644 --- a/ext/fileinfo/libmagic/funcs.c +++ b/ext/fileinfo/libmagic/funcs.c @@ -414,7 +414,7 @@ file_check_mem(struct magic_set *ms, unsigned int level) size_t len; if (level >= ms->c.len) { - len = (ms->c.len += 20) * sizeof(*ms->c.li); + len = (ms->c.len += 20 + level) * sizeof(*ms->c.li); ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ? emalloc(len) : erealloc(ms->c.li, len)); diff --git a/ext/fileinfo/tests/bug68996.phpt b/ext/fileinfo/tests/bug68996.phpt index 9fa2190..da208d3 100644 --- a/ext/fileinfo/tests/bug68996.phpt +++ b/ext/fileinfo/tests/bug68996.phpt @@ -1,14 +1,11 @@ --TEST-- Bug #68996 (Invalid free of CG(interned_empty_string)) --SKIPIF-- -<?php -if (getenv("USE_ZEND_ALLOC") !== "0") { - print "skip Need Zend MM disabled"; -} -?> <?php require_once(dirname(__FILE__) . '/skipif.inc'); ?> --INI-- html_errors=1 +--ENV-- +USE_ZEND_ALLOC=0 --FILE-- <?php finfo_open(FILEINFO_MIME_TYPE, "\xfc\x63"); @@ -19,4 +16,4 @@ finfo_open(FILEINFO_MIME_TYPE, "\xfc\x63"); <br /> <b>Warning</b>: : failed to open stream: No such file or directory in <b>%sbug68996.php</b> on line <b>%d</b><br /> <br /> -<b>Warning</b>: finfo_open(): in <b>%sbug68996.php</b> on line <b>%d</b><br /> +<b>Warning</b>: finfo_open(): Failed to load magic database at '%s�c'. in <b>%sbug68996.php</b> on line <b>%d</b><br /> diff --git a/ext/fileinfo/tests/bug71527.magic b/ext/fileinfo/tests/bug71527.magic new file mode 100644 index 0000000..14d7781 --- /dev/null +++ b/ext/fileinfo/tests/bug71527.magic @@ -0,0 +1 @@ +>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> \ No newline at end of file diff --git a/ext/fileinfo/tests/bug71527.phpt b/ext/fileinfo/tests/bug71527.phpt new file mode 100644 index 0000000..f5b1d86 --- /dev/null +++ b/ext/fileinfo/tests/bug71527.phpt @@ -0,0 +1,19 @@ +--TEST-- +Bug #71527 Buffer over-write in finfo_open with malformed magic file +--SKIPIF-- +<?php +if (!class_exists('finfo')) + die('skip no fileinfo extension'); +--ENV-- +USE_ZEND_ALLOC=0 +--FILE-- +<?php + $finfo = finfo_open(FILEINFO_NONE, dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug71527.magic"); + $info = finfo_file($finfo, __FILE__); + var_dump($info); +?> +--EXPECTF-- +Warning: finfo_open(): Failed to load magic database at '%sbug71527.magic'.. in %sbug71527.php on line %d + +Warning: finfo_file() expects parameter 1 to be resource, boolean given in %sbug71527.php on line %d +bool(false)