diff options
| author | Remi Collet <remi@php.net> | 2014-10-22 15:37:04 +0200 |
|---|---|---|
| committer | Remi Collet <remi@php.net> | 2014-10-25 11:29:16 +0200 |
| commit | 5b295bf19161b14d6c81151fd89c2f17bd50525c (patch) | |
| tree | 1d594d044431a01afebce359e5fe60c79dad3a48 /ext | |
| parent | 37d5a2b18febc07088b15f06c6e5cc73eca782a0 (diff) | |
| download | php-git-5b295bf19161b14d6c81151fd89c2f17bd50525c.tar.gz | |
Fix bug #68283: fileinfo: out-of-bounds read in elf note headers
Upstream commit
https://github.com/file/file/commit/39c7ac1106be844a5296d3eb5971946cc09ffda0
CVE -2014-3710
(cherry picked from commit 1803228597e82218a8c105e67975bc50e6f5bf0d)
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/fileinfo/libmagic/readelf.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/ext/fileinfo/libmagic/readelf.c b/ext/fileinfo/libmagic/readelf.c index 1c3845fc6b..bb6f70fb8b 100644 --- a/ext/fileinfo/libmagic/readelf.c +++ b/ext/fileinfo/libmagic/readelf.c @@ -372,6 +372,13 @@ donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size, uint32_t namesz, descsz; unsigned char *nbuf = CAST(unsigned char *, vbuf); + if (xnh_sizeof + offset > size) { + /* + * We're out of note headers. + */ + return xnh_sizeof + offset; + } + (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof); offset += xnh_sizeof; |