diff options
| author | Stanislav Malyshev <stas@php.net> | 2014-05-26 17:42:18 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2014-05-26 17:45:14 -0700 |
| commit | 57225f09edd671db50137194cb83530884cb6030 (patch) | |
| tree | 7c1be38cac523dcb2e5a9e09dc228db8e600b885 | |
| parent | f9357b44f3d0871ca737650201366a32118bc3d6 (diff) | |
| download | php-git-57225f09edd671db50137194cb83530884cb6030.tar.gz | |
Fix bug #67327: fileinfo: CDF infinite loop in nelements DoS
Upstream fix: https://github.com/file/file/commit/f97486ef5dc3e8735440edc4fc8808c63e1a3ef0
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/fileinfo/libmagic/cdf.c | 8 |
2 files changed, 11 insertions, 1 deletions
@@ -30,6 +30,10 @@ PHP NEWS . Fixed bug #67081 (DOMDocumentType->internalSubset returns entire DOCTYPE tag, not only the subset). (Anatol) +- Fileinfo: + . Fixed bug #67327 (fileinfo: CDF infinite loop in nelements DoS). + (CVE-2014-0238). + - FPM: . Fixed bug #66908 (php-fpm reload leaks epoll_create() file descriptor). (Julio Pintos) diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index dd7177ed90..99b6889ef5 100644 --- a/ext/fileinfo/libmagic/cdf.c +++ b/ext/fileinfo/libmagic/cdf.c @@ -823,6 +823,10 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, i, inp[i].pi_id, inp[i].pi_type, q - p, offs)); if (inp[i].pi_type & CDF_VECTOR) { nelements = CDF_GETUINT32(q, 1); + if (nelements == 0) { + DPRINTF(("CDF_VECTOR with nelements == 0\n")); + goto out; + } o = 2; } else { nelements = 1; @@ -897,7 +901,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, } DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n", nelements)); - for (j = 0; j < nelements; j++, i++) { + for (j = 0; j < nelements && i < sh.sh_properties; + j++, i++) + { uint32_t l = CDF_GETUINT32(q, o); inp[i].pi_str.s_len = l; inp[i].pi_str.s_buf = (const char *) |