b6cbd1
From 40ef6e07e0b2cdced57c506e08cf18f47122292d Mon Sep 17 00:00:00 2001
b6cbd1
From: Remi Collet <remi@php.net>
b6cbd1
Date: Tue, 10 Jun 2014 14:22:04 +0200
b6cbd1
Subject: [PATCH] Bug #67412 	fileinfo: cdf_count_chain insufficient
b6cbd1
 boundary check
b6cbd1
b6cbd1
Upstream:
b6cbd1
https://github.com/file/file/commit/40bade80cbe2af1d0b2cd0420cebd5d5905a2382
b6cbd1
---
b6cbd1
 ext/fileinfo/libmagic/cdf.c | 7 ++++---
b6cbd1
 1 file changed, 4 insertions(+), 3 deletions(-)
b6cbd1
b6cbd1
diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
b6cbd1
index c9a5d50..ee467a6 100644
b6cbd1
--- a/ext/fileinfo/libmagic/cdf.c
b6cbd1
+++ b/ext/fileinfo/libmagic/cdf.c
b6cbd1
@@ -470,7 +470,8 @@ size_t
b6cbd1
 cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
b6cbd1
 {
b6cbd1
 	size_t i, j;
b6cbd1
-	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
b6cbd1
+	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
b6cbd1
+	    / sizeof(maxsector));
b6cbd1
 
b6cbd1
 	DPRINTF(("Chain:"));
b6cbd1
 	for (j = i = 0; sid >= 0; i++, j++) {
b6cbd1
@@ -480,8 +481,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
b6cbd1
 			errno = EFTYPE;
b6cbd1
 			return (size_t)-1;
b6cbd1
 		}
b6cbd1
-		if (sid > maxsector) {
b6cbd1
-			DPRINTF(("Sector %d > %d\n", sid, maxsector));
b6cbd1
+		if (sid >= maxsector) {
b6cbd1
+			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
b6cbd1
 			errno = EFTYPE;
b6cbd1
 			return (size_t)-1;
b6cbd1
 		}
b6cbd1
-- 
b6cbd1
1.9.2
b6cbd1