mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-30 13:25:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #71527 Buffer over-write in finfo_open with malformed magic file

Browse Source 
The actual fix is applying the upstream patch from
6713ca45e7
This commit is contained in:
Anatol Belski 2016-03-28 00:45:19 +02:00
parent 9c19a08b9d
commit fe13566c93
3 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ext/fileinfo/libmagic/funcs.c
View File

@ -414,7 +414,7 @@ file_check_mem(struct magic_set *ms, unsigned int level)
size_t len;
if (level >= ms->c.len) {
len = (ms->c.len += 20) * sizeof(*ms->c.li);
len = (ms->c.len += 20 + level) * sizeof(*ms->c.li);
ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ?
emalloc(len) :
erealloc(ms->c.li, len));

1
ext/fileinfo/tests/bug71527.magic Normal file
View File

@ -0,0 +1 @@
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

19
ext/fileinfo/tests/bug71527.phpt Normal file
View File

@ -0,0 +1,19 @@
--TEST--
Bug #71527 Buffer over-write in finfo_open with malformed magic file
--SKIPIF--
<?php
if (!class_exists('finfo'))
die('skip no fileinfo extension');
--ENV--
USE_ZEND_ALLOC=0
--FILE--
<?php
$finfo = finfo_open(FILEINFO_NONE, dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug71527.magic");
$info = finfo_file($finfo, __FILE__);
var_dump($info);
?>
--EXPECTF--
Warning: finfo_open(): Failed to load magic database at '%sbug71527.magic'. in %sbug71527.php on line %d
Warning: finfo_file() expects parameter 1 to be resource, boolean given in %sbug71527.php on line %d
bool(false)