|
 |
b6cbd1 |
From 22736b7c56d678f142d5dd21f4996e5819507a2b Mon Sep 17 00:00:00 2001
|
|
|
b6cbd1 |
From: Stanislav Malyshev <stas@php.net>
|
|
|
b6cbd1 |
Date: Mon, 26 May 2014 17:42:18 -0700
|
|
|
b6cbd1 |
Subject: [PATCH] Fix bug #67327: fileinfo: CDF infinite loop in nelements DoS
|
|
|
b6cbd1 |
|
|
|
b6cbd1 |
Upstream fix: https://github.com/file/file/commit/f97486ef5dc3e8735440edc4fc8808c63e1a3ef0
|
|
|
b6cbd1 |
---
|
|
|
b6cbd1 |
ext/fileinfo/libmagic/cdf.c | 8 +++++++-
|
|
|
b6cbd1 |
1 file changed, 7 insertions(+), 1 deletion(-)
|
|
|
b6cbd1 |
|
|
|
b6cbd1 |
diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
|
|
|
b6cbd1 |
index 8dacd2f..4712e84 100644
|
|
|
b6cbd1 |
--- a/ext/fileinfo/libmagic/cdf.c
|
|
|
b6cbd1 |
+++ b/ext/fileinfo/libmagic/cdf.c
|
|
|
b6cbd1 |
@@ -823,6 +823,10 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
|
|
|
b6cbd1 |
i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
|
|
|
b6cbd1 |
if (inp[i].pi_type & CDF_VECTOR) {
|
|
|
b6cbd1 |
nelements = CDF_GETUINT32(q, 1);
|
|
|
b6cbd1 |
+ if (nelements == 0) {
|
|
|
b6cbd1 |
+ DPRINTF(("CDF_VECTOR with nelements == 0\n"));
|
|
|
b6cbd1 |
+ goto out;
|
|
|
b6cbd1 |
+ }
|
|
|
b6cbd1 |
o = 2;
|
|
|
b6cbd1 |
} else {
|
|
|
b6cbd1 |
nelements = 1;
|
|
|
b6cbd1 |
@@ -897,7 +901,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
|
|
|
b6cbd1 |
}
|
|
|
b6cbd1 |
DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
|
|
|
b6cbd1 |
nelements));
|
|
|
b6cbd1 |
- for (j = 0; j < nelements; j++, i++) {
|
|
|
b6cbd1 |
+ for (j = 0; j < nelements && i < sh.sh_properties;
|
|
|
b6cbd1 |
+ j++, i++)
|
|
|
b6cbd1 |
+ {
|
|
|
b6cbd1 |
uint32_t l = CDF_GETUINT32(q, o);
|
|
|
b6cbd1 |
inp[i].pi_str.s_len = l;
|
|
|
b6cbd1 |
inp[i].pi_str.s_buf = (const char *)
|
|
|
b6cbd1 |
--
|
|
|
b6cbd1 |
1.9.2
|
|
|
b6cbd1 |
|