Skip to content

Commit 0b67277

Browse files
cmb69ramsey
cmb69
authored and
ramsey
committed
Fix #81723: Memory corruption in finfo_buffer()
We need to use the same memory allocator throughout.
1 parent 1e7afbd commit 0b67277

File tree

3 files changed

+79
-53
lines changed

3 files changed

+79
-53
lines changed

‎ext/fileinfo/libmagic.patch

Lines changed: 65 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
diff -ur libmagic.orig/apprentice.c libmagic/apprentice.c
1+
diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
22
--- libmagic.orig/apprentice.c 2021-02-23 01:51:11.000000000 +0100
3-
+++ libmagic/apprentice.c 2021-04-06 21:34:57.332978922 +0200
3+
+++ libmagic/apprentice.c 2022-06-16 13:39:41.570984700 +0200
44
@@ -29,6 +29,8 @@
55
* apprentice - make one pass through /etc/magic, learning its secrets.
66
*/
@@ -925,9 +925,9 @@ diff -ur libmagic.orig/apprentice.c libmagic/apprentice.c
925925
m->str_range = swap4(m->str_range);
926926
m->str_flags = swap4(m->str_flags);
927927
}
928-
diff -ur libmagic.orig/ascmagic.c libmagic/ascmagic.c
928+
diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
929929
--- libmagic.orig/ascmagic.c 2021-02-23 01:49:06.000000000 +0100
930-
+++ libmagic/ascmagic.c 2021-04-06 21:34:57.332978922 +0200
930+
+++ libmagic/ascmagic.c 2022-06-16 13:39:41.570984700 +0200
931931
@@ -96,7 +96,7 @@
932932
rv = file_ascmagic_with_encoding(ms, &bb,
933933
ubuf, ulen, code, type, text);
@@ -956,9 +956,9 @@ diff -ur libmagic.orig/ascmagic.c libmagic/ascmagic.c
956956

957957
return rv;
958958
}
959-
diff -ur libmagic.orig/buffer.c libmagic/buffer.c
959+
diff -u libmagic.orig/buffer.c libmagic/buffer.c
960960
--- libmagic.orig/buffer.c 2021-02-23 01:49:26.000000000 +0100
961-
+++ libmagic/buffer.c 2021-04-06 21:34:57.332978922 +0200
961+
+++ libmagic/buffer.c 2021-09-21 13:27:27.982716100 +0200
962962
@@ -31,19 +31,23 @@
963963
#endif /* lint */
964964

@@ -1012,9 +1012,9 @@ diff -ur libmagic.orig/buffer.c libmagic/buffer.c
10121012
b->ebuf = NULL;
10131013
goto out;
10141014
}
1015-
diff -ur libmagic.orig/cdf.c libmagic/cdf.c
1015+
diff -u libmagic.orig/cdf.c libmagic/cdf.c
10161016
--- libmagic.orig/cdf.c 2021-02-23 01:49:06.000000000 +0100
1017-
+++ libmagic/cdf.c 2021-04-06 21:34:57.332978922 +0200
1017+
+++ libmagic/cdf.c 2021-09-21 13:27:27.983695600 +0200
10181018
@@ -43,7 +43,17 @@
10191019
#include <err.h>
10201020
#endif
@@ -1247,9 +1247,9 @@ diff -ur libmagic.orig/cdf.c libmagic/cdf.c
12471247
}
12481248

12491249
#endif
1250-
diff -ur libmagic.orig/cdf.h libmagic/cdf.h
1250+
diff -u libmagic.orig/cdf.h libmagic/cdf.h
12511251
--- libmagic.orig/cdf.h 2021-02-23 01:49:06.000000000 +0100
1252-
+++ libmagic/cdf.h 2021-04-06 21:34:57.332978922 +0200
1252+
+++ libmagic/cdf.h 2021-09-21 13:27:27.984674900 +0200
12531253
@@ -35,10 +35,10 @@
12541254
#ifndef _H_CDF_
12551255
#define _H_CDF_
@@ -1264,9 +1264,9 @@ diff -ur libmagic.orig/cdf.h libmagic/cdf.h
12641264
#endif
12651265
#ifdef __DJGPP__
12661266
#define timespec timeval
1267-
diff -ur libmagic.orig/cdf_time.c libmagic/cdf_time.c
1267+
diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
12681268
--- libmagic.orig/cdf_time.c 2021-02-23 01:49:06.000000000 +0100
1269-
+++ libmagic/cdf_time.c 2021-04-06 21:34:57.336978894 +0200
1269+
+++ libmagic/cdf_time.c 2021-09-21 13:27:27.985654400 +0200
12701270
@@ -23,6 +23,7 @@
12711271
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
12721272
* POSSIBILITY OF SUCH DAMAGE.
@@ -1293,9 +1293,9 @@ diff -ur libmagic.orig/cdf_time.c libmagic/cdf_time.c
12931293
if (ptr != NULL)
12941294
return buf;
12951295
(void)snprintf(buf, 26, "*Bad* %#16.16" INT64_T_FORMAT "x\n",
1296-
diff -ur libmagic.orig/compress.c libmagic/compress.c
1296+
diff -u libmagic.orig/compress.c libmagic/compress.c
12971297
--- libmagic.orig/compress.c 2021-02-23 01:49:07.000000000 +0100
1298-
+++ libmagic/compress.c 2021-04-06 21:34:57.336978894 +0200
1298+
+++ libmagic/compress.c 2022-06-16 13:39:41.586609800 +0200
12991299
@@ -51,7 +51,7 @@
13001300
#ifndef HAVE_SIG_T
13011301
typedef void (*sig_t)(int);
@@ -1430,9 +1430,9 @@ diff -ur libmagic.orig/compress.c libmagic/compress.c
14301430
}
14311431
#endif
14321432
+#endif
1433-
diff -ur libmagic.orig/der.c libmagic/der.c
1433+
diff -u libmagic.orig/der.c libmagic/der.c
14341434
--- libmagic.orig/der.c 2021-02-23 01:49:06.000000000 +0100
1435-
+++ libmagic/der.c 2021-04-06 21:34:57.336978894 +0200
1435+
+++ libmagic/der.c 2022-06-16 13:39:41.586609800 +0200
14361436
@@ -54,7 +54,9 @@
14371437
#include "magic.h"
14381438
#include "der.h"
@@ -1443,9 +1443,9 @@ diff -ur libmagic.orig/der.c libmagic/der.c
14431443
#include <sys/stat.h>
14441444
#include <err.h>
14451445
#endif
1446-
diff -ur libmagic.orig/elfclass.h libmagic/elfclass.h
1446+
diff -u libmagic.orig/elfclass.h libmagic/elfclass.h
14471447
--- libmagic.orig/elfclass.h 2021-02-23 01:49:06.000000000 +0100
1448-
+++ libmagic/elfclass.h 2021-04-06 21:34:57.336978894 +0200
1448+
+++ libmagic/elfclass.h 2021-09-21 13:27:27.989571700 +0200
14491449
@@ -41,7 +41,7 @@
14501450
return toomany(ms, "program headers", phnum);
14511451
flags |= FLAGS_IS_CORE;
@@ -1473,9 +1473,9 @@ diff -ur libmagic.orig/elfclass.h libmagic/elfclass.h
14731473
CAST(size_t, elf_getu16(swap, elfhdr.e_shentsize)),
14741474
fsize, elf_getu16(swap, elfhdr.e_machine),
14751475
CAST(int, elf_getu16(swap, elfhdr.e_shstrndx)),
1476-
diff -ur libmagic.orig/encoding.c libmagic/encoding.c
1476+
diff -u libmagic.orig/encoding.c libmagic/encoding.c
14771477
--- libmagic.orig/encoding.c 2021-02-23 01:49:06.000000000 +0100
1478-
+++ libmagic/encoding.c 2021-04-06 21:34:57.336978894 +0200
1478+
+++ libmagic/encoding.c 2022-06-16 13:39:41.586609800 +0200
14791479
@@ -98,14 +98,14 @@
14801480
nbytes = ms->encoding_max;
14811481

@@ -1514,9 +1514,9 @@ diff -ur libmagic.orig/encoding.c libmagic/encoding.c
15141514
} \
15151515
if (u < 3) \
15161516
return 0; \
1517-
diff -ur libmagic.orig/file.h libmagic/file.h
1517+
diff -u libmagic.orig/file.h libmagic/file.h
15181518
--- libmagic.orig/file.h 2021-02-23 01:49:06.000000000 +0100
1519-
+++ libmagic/file.h 2021-04-06 21:34:57.336978894 +0200
1519+
+++ libmagic/file.h 2022-06-16 13:39:41.586609800 +0200
15201520
@@ -33,17 +33,14 @@
15211521
#ifndef __file_h__
15221522
#define __file_h__
@@ -1775,9 +1775,9 @@ diff -ur libmagic.orig/file.h libmagic/file.h
17751775
+#endif
17761776
+
17771777
#endif /* __file_h__ */
1778-
diff -ur libmagic.orig/fsmagic.c libmagic/fsmagic.c
1778+
diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
17791779
--- libmagic.orig/fsmagic.c 2021-02-23 01:49:06.000000000 +0100
1780-
+++ libmagic/fsmagic.c 2021-04-06 21:34:57.336978894 +0200
1780+
+++ libmagic/fsmagic.c 2021-09-21 13:27:27.992511000 +0200
17811781
@@ -66,26 +66,10 @@
17821782
# define minor(dev) ((dev) & 0xff)
17831783
#endif
@@ -2068,9 +2068,9 @@ diff -ur libmagic.orig/fsmagic.c libmagic/fsmagic.c
20682068
#ifdef S_IFSOCK
20692069
#ifndef __COHERENT__
20702070
case S_IFSOCK:
2071-
diff -ur libmagic.orig/funcs.c libmagic/funcs.c
2071+
diff -u libmagic.orig/funcs.c libmagic/funcs.c
20722072
--- libmagic.orig/funcs.c 2021-02-23 01:49:06.000000000 +0100
2073-
+++ libmagic/funcs.c 2021-04-06 21:34:57.336978894 +0200
2073+
+++ libmagic/funcs.c 2022-06-16 13:39:41.586609800 +0200
20742074
@@ -51,6 +51,13 @@
20752075
#define SIZE_MAX ((size_t)~0)
20762076
#endif
@@ -2388,9 +2388,9 @@ diff -ur libmagic.orig/funcs.c libmagic/funcs.c
23882388

23892389
protected char *
23902390
file_strtrim(char *str)
2391-
diff -ur libmagic.orig/magic.c libmagic/magic.c
2391+
diff -u libmagic.orig/magic.c libmagic/magic.c
23922392
--- libmagic.orig/magic.c 2021-02-23 01:49:06.000000000 +0100
2393-
+++ libmagic/magic.c 2021-04-06 21:34:57.336978894 +0200
2393+
+++ libmagic/magic.c 2022-06-16 13:39:41.586609800 +0200
23942394
@@ -25,11 +25,6 @@
23952395
* SUCH DAMAGE.
23962396
*/
@@ -2867,9 +2867,9 @@ diff -ur libmagic.orig/magic.c libmagic/magic.c
28672867
return NULL;
28682868
}
28692869
return file_getbuffer(ms);
2870-
diff -ur libmagic.orig/magic.h libmagic/magic.h
2871-
--- libmagic.orig/magic.h 2021-04-06 22:37:37.647426536 +0200
2872-
+++ libmagic/magic.h 2021-04-06 21:34:57.336978894 +0200
2870+
diff -u libmagic.orig/magic.h libmagic/magic.h
2871+
--- libmagic.orig/magic.h 2022-06-30 17:16:06.144009900 +0200
2872+
+++ libmagic/magic.h 2022-06-16 13:39:41.586609800 +0200
28732873
@@ -126,6 +126,7 @@
28742874

28752875
const char *magic_getpath(const char *, int);
@@ -2878,9 +2878,9 @@ diff -ur libmagic.orig/magic.h libmagic/magic.h
28782878
const char *magic_descriptor(magic_t, int);
28792879
const char *magic_buffer(magic_t, const void *, size_t);
28802880

2881-
diff -ur libmagic.orig/print.c libmagic/print.c
2881+
diff -u libmagic.orig/print.c libmagic/print.c
28822882
--- libmagic.orig/print.c 2021-02-23 01:49:07.000000000 +0100
2883-
+++ libmagic/print.c 2021-04-06 21:34:57.340978869 +0200
2883+
+++ libmagic/print.c 2021-09-21 13:27:27.998388700 +0200
28842884
@@ -28,6 +28,7 @@
28852885
/*
28862886
* print.c - debugging printout routines
@@ -2943,9 +2943,9 @@ diff -ur libmagic.orig/print.c libmagic/print.c
29432943

29442944
if (pp == NULL)
29452945
goto out;
2946-
diff -ur libmagic.orig/readcdf.c libmagic/readcdf.c
2946+
diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
29472947
--- libmagic.orig/readcdf.c 2021-02-23 01:49:08.000000000 +0100
2948-
+++ libmagic/readcdf.c 2021-04-06 21:34:57.340978869 +0200
2948+
+++ libmagic/readcdf.c 2021-09-21 13:27:27.999369100 +0200
29492949
@@ -31,7 +31,11 @@
29502950

29512951
#include <assert.h>
@@ -3067,9 +3067,9 @@ diff -ur libmagic.orig/readcdf.c libmagic/readcdf.c
30673067
out0:
30683068
/* If we handled it already, return */
30693069
if (i != -1)
3070-
diff -ur libmagic.orig/softmagic.c libmagic/softmagic.c
3070+
diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
30713071
--- libmagic.orig/softmagic.c 2021-02-23 01:49:06.000000000 +0100
3072-
+++ libmagic/softmagic.c 2021-04-06 21:34:57.340978869 +0200
3072+
+++ libmagic/softmagic.c 2022-06-30 16:58:15.521661800 +0200
30733073
@@ -43,6 +43,10 @@
30743074
#include <time.h>
30753075
#include "der.h"
@@ -3247,7 +3247,29 @@ diff -ur libmagic.orig/softmagic.c libmagic/softmagic.c
32473247
return rv;
32483248
}
32493249

3250-
@@ -1845,15 +1847,15 @@
3250+
@@ -1531,11 +1533,7 @@
3251+
size_t len;
3252+
*c = ms->c;
3253+
len = c->len * sizeof(*c->li);
3254+
- ms->c.li = CAST(struct level_info *, malloc(len));
3255+
- if (ms->c.li == NULL) {
3256+
- ms->c = *c;
3257+
- return -1;
3258+
- }
3259+
+ ms->c.li = CAST(struct level_info *, emalloc(len));
3260+
memcpy(ms->c.li, c->li, len);
3261+
return 0;
3262+
}
3263+
@@ -1543,7 +1541,7 @@
3264+
private void
3265+
restore_cont(struct magic_set *ms, struct cont *c)
3266+
{
3267+
- free(ms->c.li);
3268+
+ efree(ms->c.li);
3269+
ms->c = *c;
3270+
}
3271+
3272+
@@ -1845,15 +1843,15 @@
32513273
if ((ms->flags & MAGIC_NODESC) == 0 &&
32523274
file_printf(ms, F(ms, m->desc, "%u"), offset) == -1)
32533275
{
@@ -3266,7 +3288,7 @@ diff -ur libmagic.orig/softmagic.c libmagic/softmagic.c
32663288
return rv;
32673289

32683290
case FILE_USE:
3269-
@@ -1958,10 +1960,13 @@
3291+
@@ -1958,10 +1956,13 @@
32703292
}
32713293
else if ((flags & STRING_COMPACT_WHITESPACE) &&
32723294
isspace(*a)) {
@@ -3281,7 +3303,7 @@ diff -ur libmagic.orig/softmagic.c libmagic/softmagic.c
32813303
b++;
32823304
}
32833305
else {
3284-
@@ -1997,6 +2002,60 @@
3306+
@@ -1997,6 +1998,60 @@
32853307
return file_strncmp(a, b, len, maxlen, flags);
32863308
}
32873309

@@ -3342,7 +3364,7 @@ diff -ur libmagic.orig/softmagic.c libmagic/softmagic.c
33423364
private int
33433365
magiccheck(struct magic_set *ms, struct magic *m)
33443366
{
3345-
@@ -2176,65 +2235,77 @@
3367+
@@ -2176,65 +2231,77 @@
33463368
break;
33473369
}
33483370
case FILE_REGEX: {
@@ -3471,9 +3493,9 @@ diff -ur libmagic.orig/softmagic.c libmagic/softmagic.c
34713493
break;
34723494
}
34733495
case FILE_USE:
3474-
diff -ur libmagic.orig/strcasestr.c libmagic/strcasestr.c
3496+
diff -u libmagic.orig/strcasestr.c libmagic/strcasestr.c
34753497
--- libmagic.orig/strcasestr.c 2021-02-23 01:49:12.000000000 +0100
3476-
+++ libmagic/strcasestr.c 2021-04-06 21:34:57.340978869 +0200
3498+
+++ libmagic/strcasestr.c 2021-09-21 13:27:28.002306200 +0200
34773499
@@ -39,6 +39,8 @@
34783500

34793501
#include "file.h"
@@ -3483,7 +3505,3 @@ diff -ur libmagic.orig/strcasestr.c libmagic/strcasestr.c
34833505
#include <assert.h>
34843506
#include <ctype.h>
34853507
#include <string.h>
3486-
--- libmagic/config.h 2021-04-06 22:19:57.552120067 +0200
3487-
+++ /dev/null 2021-03-31 20:37:24.776503884 +0200
3488-
@@ -1 +0,0 @@
3489-
-#include "php.h"

‎ext/fileinfo/libmagic/softmagic.c

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1533,19 +1533,15 @@ save_cont(struct magic_set *ms, struct cont *c)
15331533
size_t len;
15341534
*c = ms->c;
15351535
len = c->len * sizeof(*c->li);
1536-
ms->c.li = CAST(struct level_info *, malloc(len));
1537-
if (ms->c.li == NULL) {
1538-
ms->c = *c;
1539-
return -1;
1540-
}
1536+
ms->c.li = CAST(struct level_info *, emalloc(len));
15411537
memcpy(ms->c.li, c->li, len);
15421538
return 0;
15431539
}
15441540

15451541
private void
15461542
restore_cont(struct magic_set *ms, struct cont *c)
15471543
{
1548-
free(ms->c.li);
1544+
efree(ms->c.li);
15491545
ms->c = *c;
15501546
}
15511547

‎ext/fileinfo/tests/bug81723.phpt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
--TEST--
2+
Bug #81723 (Memory corruption in finfo_buffer())
3+
--EXTENSIONS--
4+
fileinfo
5+
--FILE--
6+
<?php
7+
$data = hex2bin("00018a7570001097db97979897977d87979797000092001f0051000000000000000000ffff7fff00000000001e0000000000000000000000000c0000000000000000000000000000dc0000000100000000000000004f011900007f0000000000180039000000000000000000000000000000dc0000000100000000000000004f011900007f0000f500000000eeff0000000000000000010000fd00");
8+
9+
$f = finfo_open();
10+
finfo_buffer($f, $data);
11+
?>
12+
--EXPECT--

0 commit comments

Comments
 (0)