From 5b295bf19161b14d6c81151fd89c2f17bd50525c Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Wed, 22 Oct 2014 15:37:04 +0200 Subject: [PATCH 1/2] Fix bug #68283: fileinfo: out-of-bounds read in elf note headers Upstream commit https://github.com/file/file/commit/39c7ac1106be844a5296d3eb5971946cc09ffda0 CVE -2014-3710 (cherry picked from commit 1803228597e82218a8c105e67975bc50e6f5bf0d) --- ext/fileinfo/libmagic/readelf.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ext/fileinfo/libmagic/readelf.c b/ext/fileinfo/libmagic/readelf.c index 1c3845fc6b1..bb6f70fb8b7 100644 --- a/ext/fileinfo/libmagic/readelf.c +++ b/ext/fileinfo/libmagic/readelf.c @@ -372,6 +372,13 @@ donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size, uint32_t namesz, descsz; unsigned char *nbuf = CAST(unsigned char *, vbuf); + if (xnh_sizeof + offset > size) { + /* + * We're out of note headers. + */ + return xnh_sizeof + offset; + } + (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof); offset += xnh_sizeof; From ec3d25fcbda6109c4ae353b768d59e25af854712 Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Sat, 25 Oct 2014 11:29:53 +0200 Subject: [PATCH 2/2] NEWS --- NEWS | 2 ++ 1 file changed, 2 insertions(+) diff --git a/NEWS b/NEWS index e111df21670..abcaa7b461e 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,8 @@ PHP NEWS - Fileinfo: . Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB) + . Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers). + (CVE-2014-3710) (Remi) - GD: . Fixed bug #65171 (imagescale() fails without height param). (Remi)