b6cbd1
From 5c9f96799961818944d43b22c241cc56c215c2e4 Mon Sep 17 00:00:00 2001
b6cbd1
From: Remi Collet <remi@php.net>
b6cbd1
Date: Tue, 10 Jun 2014 14:13:14 +0200
b6cbd1
Subject: [PATCH] Fixed Bug #67411 	fileinfo: cdf_check_stream_offset
b6cbd1
 insufficient boundary check
b6cbd1
b6cbd1
Upstream:
b6cbd1
https://github.com/file/file/commit/36fadd29849b8087af9f4586f89dbf74ea45be67
b6cbd1
---
b6cbd1
 ext/fileinfo/libmagic/cdf.c | 6 ++++--
b6cbd1
 1 file changed, 4 insertions(+), 2 deletions(-)
b6cbd1
b6cbd1
diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
b6cbd1
index 16649f1..c9a5d50 100644
b6cbd1
--- a/ext/fileinfo/libmagic/cdf.c
b6cbd1
+++ b/ext/fileinfo/libmagic/cdf.c
b6cbd1
@@ -277,13 +277,15 @@ cdf_check_stream_offset(const cdf_stream_t *sst, const cdf_header_t *h,
b6cbd1
 {
b6cbd1
 	const char *b = (const char *)sst->sst_tab;
b6cbd1
 	const char *e = ((const char *)p) + tail;
b6cbd1
+	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
b6cbd1
+	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
b6cbd1
 	(void)&line;
b6cbd1
-	if (e >= b && (size_t)(e - b) <= CDF_SEC_SIZE(h) * sst->sst_len)
b6cbd1
+	if (e >= b && (size_t)(e - b) <= ss * sst->sst_len)
b6cbd1
 		return 0;
b6cbd1
 	DPRINTF(("%d: offset begin %p < end %p || %" SIZE_T_FORMAT "u"
b6cbd1
 	    " > %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %"
b6cbd1
 	    SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b),
b6cbd1
-	    CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len));
b6cbd1
+	    ss * sst->sst_len, ss, sst->sst_len));
b6cbd1
 	errno = EFTYPE;
b6cbd1
 	return -1;
b6cbd1
 }
b6cbd1
-- 
b6cbd1
1.9.2
b6cbd1