Blame SOURCES/file-5.11-CVE-2014-3480.patch
|
 |
89be67 |
From 40ef6e07e0b2cdced57c506e08cf18f47122292d Mon Sep 17 00:00:00 2001
|
|
|
89be67 |
From: Remi Collet <remi@php.net>
|
|
|
89be67 |
Date: Tue, 10 Jun 2014 14:22:04 +0200
|
|
|
89be67 |
Subject: [PATCH] Bug #67412 fileinfo: cdf_count_chain insufficient
|
|
|
89be67 |
boundary check
|
|
|
89be67 |
|
|
|
89be67 |
Upstream:
|
|
|
89be67 |
https://github.com/file/file/commit/40bade80cbe2af1d0b2cd0420cebd5d5905a2382
|
|
|
89be67 |
---
|
|
|
89be67 |
ext/fileinfo/libmagic/cdf.c | 7 ++++---
|
|
|
89be67 |
1 file changed, 4 insertions(+), 3 deletions(-)
|
|
|
89be67 |
|
|
|
89be67 |
diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
|
|
|
89be67 |
index c9a5d50..ee467a6 100644
|
|
|
89be67 |
--- a/src/cdf.c
|
|
|
89be67 |
+++ b/src/cdf.c
|
|
|
89be67 |
@@ -457,7 +457,8 @@ size_t
|
|
|
89be67 |
cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
|
|
|
89be67 |
{
|
|
|
89be67 |
size_t i, j;
|
|
|
89be67 |
- cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
|
|
|
89be67 |
+ cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
|
|
|
89be67 |
+ / sizeof(maxsector));
|
|
|
89be67 |
|
|
|
89be67 |
DPRINTF(("Chain:"));
|
|
|
89be67 |
for (j = i = 0; sid >= 0; i++, j++) {
|
|
|
89be67 |
@@ -467,8 +468,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
|
|
|
89be67 |
errno = EFTYPE;
|
|
|
89be67 |
return (size_t)-1;
|
|
|
89be67 |
}
|
|
|
89be67 |
- if (sid > maxsector) {
|
|
|
89be67 |
- DPRINTF(("Sector %d > %d\n", sid, maxsector));
|
|
|
89be67 |
+ if (sid >= maxsector) {
|
|
|
89be67 |
+ DPRINTF(("Sector %d >= %d\n", sid, maxsector));
|
|
|
89be67 |
errno = EFTYPE;
|
|
|
89be67 |
return (size_t)-1;
|
|
|
89be67 |
}
|
|
|
89be67 |
--
|
|
|
89be67 |
1.9.2
|
|
|
89be67 |
|