Blame SOURCES/file-5.11-CVE-2014-3538.patch

0233e9
diff --git a/src/softmagic.c b/src/softmagic.c
0233e9
index f848f94..ee979b9 100644
0233e9
--- a/src/softmagic.c
0233e9
+++ b/src/softmagic.c
0233e9
@@ -50,7 +50,7 @@ private int32_t mprint(struct magic_set *, struct magic *);
0233e9
 private int32_t moffset(struct magic_set *, struct magic *);
0233e9
 private void mdebug(uint32_t, const char *, size_t);
0233e9
 private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
0233e9
-    const unsigned char *, uint32_t, size_t, size_t);
0233e9
+    const unsigned char *, uint32_t, size_t, struct magic *);
0233e9
 private int mconvert(struct magic_set *, struct magic *);
0233e9
 private int print_sep(struct magic_set *, int);
0233e9
 private int handle_annotation(struct magic_set *, struct magic *);
0233e9
@@ -936,7 +936,7 @@ mdebug(uint32_t offset, const char *str, size_t len)
0233e9
 
0233e9
 private int
0233e9
 mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
0233e9
-    const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
0233e9
+    const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
0233e9
 {
0233e9
 	/*
0233e9
 	 * Note: FILE_SEARCH and FILE_REGEX do not actually copy
0233e9
@@ -956,15 +956,24 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
0233e9
 			const char *last;	/* end of search region */
0233e9
 			const char *buf;	/* start of search region */
0233e9
 			const char *end;
0233e9
-			size_t lines;
0233e9
+			size_t lines, linecnt, bytecnt;
0233e9
 
0233e9
+			linecnt = m->str_range;
0233e9
+			bytecnt = linecnt * 80;
0233e9
+
0233e9
+			if (bytecnt == 0) {
0233e9
+				bytecnt = 8192;
0233e9
+			}
0233e9
+			if (bytecnt > nbytes) {
0233e9
+				bytecnt = nbytes;
0233e9
+			}
0233e9
 			if (s == NULL) {
0233e9
 				ms->search.s_len = 0;
0233e9
 				ms->search.s = NULL;
0233e9
 				return 0;
0233e9
 			}
0233e9
 			buf = RCAST(const char *, s) + offset;
0233e9
-			end = last = RCAST(const char *, s) + nbytes;
0233e9
+			end = last = RCAST(const char *, s) + bytecnt;
0233e9
 			/* mget() guarantees buf <= last */
0233e9
 			for (lines = linecnt, b = buf; lines && b < end &&
0233e9
 			     ((b = CAST(const char *,
0233e9
@@ -977,7 +986,7 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
0233e9
 					b++;
0233e9
 			}
0233e9
 			if (lines)
0233e9
-				last = RCAST(const char *, s) + nbytes;
0233e9
+				last = RCAST(const char *, s) + bytecnt;
0233e9
 
0233e9
 			ms->search.s = buf;
0233e9
 			ms->search.s_len = last - buf;
0233e9
@@ -1050,7 +1059,6 @@ mget(struct magic_set *ms, const unsigned char *s,
0233e9
 	int recursion_level)
0233e9
 {
0233e9
 	uint32_t offset = ms->offset;
0233e9
-	uint32_t count = m->str_range;
0233e9
 	union VALUETYPE *p = &ms->ms_value;
0233e9
 
0233e9
 	if (recursion_level >= 20) {
0233e9
@@ -1058,7 +1066,7 @@ mget(struct magic_set *ms, const unsigned char *s,
0233e9
 		return -1;
0233e9
 	}
0233e9
 
0233e9
-	if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, nbytes, count) == -1)
0233e9
+	if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, (uint32_t)nbytes, m) == -1)
0233e9
 		return -1;
0233e9
 
0233e9
 	if ((ms->flags & MAGIC_DEBUG) != 0) {
0233e9
@@ -1546,7 +1554,7 @@ mget(struct magic_set *ms, const unsigned char *s,
0233e9
 		if (m->flag & INDIROFFADD) {
0233e9
 			offset += ms->c.li[cont_level-1].off;
0233e9
 		}
0233e9
-		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
0233e9
+		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
0233e9
 			return -1;
0233e9
 		ms->offset = offset;
0233e9