From fe13566c93f118a15a96320a546c7878fd0cfc5e Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Mon, 28 Mar 2016 00:45:19 +0200 Subject: Fixed bug #71527 Buffer over-write in finfo_open with malformed magic file The actual fix is applying the upstream patch from https://github.com/file/file/commit/6713ca45e7757297381f4b4cdb9cf5e624a9ad36 --- ext/fileinfo/libmagic/funcs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'ext/fileinfo/libmagic') diff --git a/ext/fileinfo/libmagic/funcs.c b/ext/fileinfo/libmagic/funcs.c index 011ca42757..def2f7b31b 100644 --- a/ext/fileinfo/libmagic/funcs.c +++ b/ext/fileinfo/libmagic/funcs.c @@ -414,7 +414,7 @@ file_check_mem(struct magic_set *ms, unsigned int level) size_t len; if (level >= ms->c.len) { - len = (ms->c.len += 20) * sizeof(*ms->c.li); + len = (ms->c.len += 20 + level) * sizeof(*ms->c.li); ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ? emalloc(len) : erealloc(ms->c.li, len)); -- cgit v1.2.1