|
 |
2067da |
From a33759fd275b32ed0bbe89796fe2953b3cb0b41f Mon Sep 17 00:00:00 2001
|
|
|
2067da |
From: Remi Collet <remi@php.net>
|
|
|
2067da |
Date: Tue, 4 Mar 2014 20:32:52 +0100
|
|
|
2067da |
Subject: [PATCH] Fixed Bug #66820 out-of-bounds memory access in fileinfo
|
|
|
2067da |
|
|
|
2067da |
Upstream fix:
|
|
|
2067da |
https://github.com/glensc/file/commit/447558595a3650db2886cd2f416ad0beba965801
|
|
|
2067da |
|
|
|
2067da |
Notice, test changed, with upstream agreement:
|
|
|
2067da |
-define OFFSET_OOB(n, o, i) ((n) < (o) || (i) >= ((n) - (o)))
|
|
|
2067da |
+define OFFSET_OOB(n, o, i) ((n) < (o) || (i) > ((n) - (o)))
|
|
|
2067da |
---
|
|
|
2067da |
ext/fileinfo/libmagic/softmagic.c | 34 ++++++++++++++++++----------------
|
|
|
2067da |
1 file changed, 18 insertions(+), 16 deletions(-)
|
|
|
2067da |
|
|
|
2067da |
diff --git a/ext/fileinfo/libmagic/softmagic.c b/ext/fileinfo/libmagic/softmagic.c
|
|
|
2067da |
index 82a470a..21fea6b 100644
|
|
|
2067da |
--- a/ext/fileinfo/libmagic/softmagic.c
|
|
|
2067da |
+++ b/ext/fileinfo/libmagic/softmagic.c
|
|
|
2067da |
@@ -67,6 +67,8 @@ private void cvt_16(union VALUETYPE *, const struct magic *);
|
|
|
2067da |
private void cvt_32(union VALUETYPE *, const struct magic *);
|
|
|
2067da |
private void cvt_64(union VALUETYPE *, const struct magic *);
|
|
|
2067da |
|
|
|
2067da |
+#define OFFSET_OOB(n, o, i) ((n) < (o) || (i) > ((n) - (o)))
|
|
|
2067da |
+
|
|
|
2067da |
/*
|
|
|
2067da |
* softmagic - lookup one file in parsed, in-memory copy of database
|
|
|
2067da |
* Passed the name and FILE * of one file to be typed.
|
|
|
2067da |
@@ -1171,7 +1173,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
|
|
|
2067da |
}
|
|
|
2067da |
switch (cvt_flip(m->in_type, flip)) {
|
|
|
2067da |
case FILE_BYTE:
|
|
|
2067da |
- if (nbytes < (offset + 1))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 1))
|
|
|
2067da |
return 0;
|
|
|
2067da |
if (off) {
|
|
|
2067da |
switch (m->in_op & FILE_OPS_MASK) {
|
|
|
2067da |
@@ -1206,7 +1208,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
|
|
|
2067da |
offset = ~offset;
|
|
|
2067da |
break;
|
|
|
2067da |
case FILE_BESHORT:
|
|
|
2067da |
- if (nbytes < (offset + 2))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 2))
|
|
|
2067da |
return 0;
|
|
|
2067da |
if (off) {
|
|
|
2067da |
switch (m->in_op & FILE_OPS_MASK) {
|
|
|
2067da |
@@ -1258,7 +1260,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
|
|
|
2067da |
offset = ~offset;
|
|
|
2067da |
break;
|
|
|
2067da |
case FILE_LESHORT:
|
|
|
2067da |
- if (nbytes < (offset + 2))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 2))
|
|
|
2067da |
return 0;
|
|
|
2067da |
if (off) {
|
|
|
2067da |
switch (m->in_op & FILE_OPS_MASK) {
|
|
|
2067da |
@@ -1310,7 +1312,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
|
|
|
2067da |
offset = ~offset;
|
|
|
2067da |
break;
|
|
|
2067da |
case FILE_SHORT:
|
|
|
2067da |
- if (nbytes < (offset + 2))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 2))
|
|
|
2067da |
return 0;
|
|
|
2067da |
if (off) {
|
|
|
2067da |
switch (m->in_op & FILE_OPS_MASK) {
|
|
|
2067da |
@@ -1347,7 +1349,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
|
|
|
2067da |
break;
|
|
|
2067da |
case FILE_BELONG:
|
|
|
2067da |
case FILE_BEID3:
|
|
|
2067da |
- if (nbytes < (offset + 4))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 4))
|
|
|
2067da |
return 0;
|
|
|
2067da |
if (off) {
|
|
|
2067da |
switch (m->in_op & FILE_OPS_MASK) {
|
|
|
2067da |
@@ -1418,7 +1420,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
|
|
|
2067da |
break;
|
|
|
2067da |
case FILE_LELONG:
|
|
|
2067da |
case FILE_LEID3:
|
|
|
2067da |
- if (nbytes < (offset + 4))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 4))
|
|
|
2067da |
return 0;
|
|
|
2067da |
if (off) {
|
|
|
2067da |
switch (m->in_op & FILE_OPS_MASK) {
|
|
|
2067da |
@@ -1488,7 +1490,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
|
|
|
2067da |
offset = ~offset;
|
|
|
2067da |
break;
|
|
|
2067da |
case FILE_MELONG:
|
|
|
2067da |
- if (nbytes < (offset + 4))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 4))
|
|
|
2067da |
return 0;
|
|
|
2067da |
if (off) {
|
|
|
2067da |
switch (m->in_op & FILE_OPS_MASK) {
|
|
|
2067da |
@@ -1558,7 +1560,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
|
|
|
2067da |
offset = ~offset;
|
|
|
2067da |
break;
|
|
|
2067da |
case FILE_LONG:
|
|
|
2067da |
- if (nbytes < (offset + 4))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 4))
|
|
|
2067da |
return 0;
|
|
|
2067da |
if (off) {
|
|
|
2067da |
switch (m->in_op & FILE_OPS_MASK) {
|
|
|
2067da |
@@ -1630,14 +1632,14 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
|
|
|
2067da |
/* Verify we have enough data to match magic type */
|
|
|
2067da |
switch (m->type) {
|
|
|
2067da |
case FILE_BYTE:
|
|
|
2067da |
- if (nbytes < (offset + 1)) /* should alway be true */
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 1))
|
|
|
2067da |
return 0;
|
|
|
2067da |
break;
|
|
|
2067da |
|
|
|
2067da |
case FILE_SHORT:
|
|
|
2067da |
case FILE_BESHORT:
|
|
|
2067da |
case FILE_LESHORT:
|
|
|
2067da |
- if (nbytes < (offset + 2))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 2))
|
|
|
2067da |
return 0;
|
|
|
2067da |
break;
|
|
|
2067da |
|
|
|
2067da |
@@ -1656,33 +1658,33 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
|
|
|
2067da |
case FILE_FLOAT:
|
|
|
2067da |
case FILE_BEFLOAT:
|
|
|
2067da |
case FILE_LEFLOAT:
|
|
|
2067da |
- if (nbytes < (offset + 4))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 4))
|
|
|
2067da |
return 0;
|
|
|
2067da |
break;
|
|
|
2067da |
|
|
|
2067da |
case FILE_DOUBLE:
|
|
|
2067da |
case FILE_BEDOUBLE:
|
|
|
2067da |
case FILE_LEDOUBLE:
|
|
|
2067da |
- if (nbytes < (offset + 8))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 8))
|
|
|
2067da |
return 0;
|
|
|
2067da |
break;
|
|
|
2067da |
|
|
|
2067da |
case FILE_STRING:
|
|
|
2067da |
case FILE_PSTRING:
|
|
|
2067da |
case FILE_SEARCH:
|
|
|
2067da |
- if (nbytes < (offset + m->vallen))
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, m->vallen))
|
|
|
2067da |
return 0;
|
|
|
2067da |
break;
|
|
|
2067da |
|
|
|
2067da |
case FILE_REGEX:
|
|
|
2067da |
- if (nbytes < offset)
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 0))
|
|
|
2067da |
return 0;
|
|
|
2067da |
break;
|
|
|
2067da |
|
|
|
2067da |
case FILE_INDIRECT:
|
|
|
2067da |
if (offset == 0)
|
|
|
2067da |
return 0;
|
|
|
2067da |
- if (nbytes < offset)
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 0))
|
|
|
2067da |
return 0;
|
|
|
2067da |
sbuf = ms->o.buf;
|
|
|
2067da |
soffset = ms->offset;
|
|
|
2067da |
@@ -1716,7 +1718,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
|
|
|
2067da |
return rv;
|
|
|
2067da |
|
|
|
2067da |
case FILE_USE:
|
|
|
2067da |
- if (nbytes < offset)
|
|
|
2067da |
+ if (OFFSET_OOB(nbytes, offset, 0))
|
|
|
2067da |
return 0;
|
|
|
2067da |
sbuf = m->value.s;
|
|
|
2067da |
if (*sbuf == '^') {
|
|
|
2067da |
--
|
|
|
2067da |
1.8.4.3
|
|
|
2067da |
|