/
ChangeLog
2069 lines (1234 loc) · 59.4 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
2022-09-13 14:55 Christos Zoulas <christos@zoulas.com>
* release 5.43
2022-09-10 9:17 Christos Zoulas <christos@zoulas.com>
* Add octal indirect magic (Michal Gorny)
2022-08-17 11:43 Christos Zoulas <christos@zoulas.com>
* PR/374: avoid infinite loop in non-wide code (piru)
* PR/373: Obey MAGIC_CONTINUE with multiple magic files (vismarli)
2022-07-26 11:10 Christos Zoulas <christos@zoulas.com>
* Fix bug with large flist (Florian Weimer)
2022-07-07 13:21 Christos Zoulas <christos@zoulas.com>
* PR/364: Detect non-nul-terminated core filenames from QEMU
(mam-ableton)
2022-07-04 15:45 Christos Zoulas <christos@zoulas.com>
* PR/359: Add support for http://ndjson.org/ (darose)
* PR/362: Fix wide printing (ro-ee)
* PR/358: Fix width for -f - (jpalus)
* PR/356: Fix JSON constant parsing (davewhite)
2022-06-10 9:40 Christos Zoulas <christos@zoulas.com>
* release 5.42
2022-05-31 14:50 Christos Zoulas <christos@zoulas.com>
* PR/348: add missing cases to prevent file from aborting on
random magic files.
2022-05-27 21:05 Christos Zoulas <christos@zoulas.com>
* PR/351: octalify filenames when not raw before printing.
2022-04-18 17:51 Christos Zoulas <christos@zoulas.com>
* fix regex cacheing bug (Dirk Mueller)
* merge file_regcomp and file_regerror() to simplify the code
and reduce memory requirements for storing regexes (Dirk Mueller)
2022-03-19 12:56 Christos Zoulas <christos@zoulas.com>
* cache regex (Dirk Mueller)
* detect filesystem full by flushing output (Dirk Mueller)
2021-11-19 12:36 Christos Zoulas <christos@zoulas.com>
* implement running decompressor programs using
posix_spawnp(2) instead of vfork(2)
2021-10-24 11:51 Christos Zoulas <christos@zoulas.com>
* Add support for msdos dates and times
2021-10-20 9:55 Christos Zoulas <christos@zoulas.com>
* use the system byte swapping functions if available (Werner Fink)
2021-10-18 11:57 Christos Zoulas <christos@zoulas.com>
* release 5.41
2021-09-23 03:51 Christos Zoulas <christos@zoulas.com>
* Avinash Sonawane: Fix tzname detection
2021-09-03 09:17 Christos Zoulas <christos@zoulas.com>
* Fix relationship tests with "search" magic, don't short circuit
logic
2021-07-13 01:06 Christos Zoulas <christos@zoulas.com>
* Fix memory leak in compile mode
2021-07-01 03:51 Christos Zoulas <christos@zoulas.com>
* PR/272: kiefermat: Only set returnval = 1 when we printed something
(in all cases print or !print). This simplifies the logic and fixes
the issue in the PR with -k and --mime-type there was no continuation
printed before the default case.
2021-06-30 13:07 Christos Zoulas <christos@zoulas.com>
* PR/270: Don't translate unprintable characters in %s magic formats
when -r
* PR/269: Avoid undefined behavior with clang (adding offset to NULL)
2021-05-09 18:38 Christos Zoulas <christos@zoulas.com>
* Add a new flag (f) that requires that the match is a full word,
not a partial word match.
* Add varint types (unused)
2021-04-19 17:17 Christos Zoulas <christos@zoulas.com>
* PR/256: mutableVoid: If the file is less than 3 bytes, use the file
length to determine type
* PR/259: aleksandr.v.novichkov: mime printing through indirect magic
is not taken into account, use match directly so that it does.
2021-04-04 17:02 Christos Zoulas <christos@zoulas.com>
* count the total bytes found not the total byte positions
in order to determine encoding (Anatol Belski)
2021-03-30 20:21 Christos Zoulas <christos@zoulas.com>
* release 5.40
2021-02-05 16:31 Christos Zoulas <christos@zoulas.com>
* PR/234: Add limit to the number of bytes to scan for encoding
* PR/230: Fix /T (trim flag) for regex
2021-02-01 12:31 Christos Zoulas <christos@zoulas.com>
* PR/77: Trim trailing separator.
2020-12-17 15:44 Christos Zoulas <christos@zoulas.com>
* PR/211: Convert system read errors from corrupt ELF
files into human readable error messages
2020-12-08 16:24 Christos Zoulas <christos@zoulas.com>
* fix multithreaded decompression file descriptor issue
by using close-on-exec (Denys Vlasenko)
2020-06-27 11:58 Christos Zoulas <christos@zoulas.com>
* Exclude surrogate pairs from utf-8 detection (Michael Liu)
2020-06-25 12:53 Christos Zoulas <christos@zoulas.com>
* Include # to the list of ignored format chars (Werner Fink)
2020-06-14 20:02 Christos Zoulas <christos@zoulas.com>
* release 5.39
2020-06-07 20:00 Christos Zoulas <christos@zoulas.com>
* Remove unused subtype_mime (Steve Grubb)
* Remove unused check in okstat (Steve Grubb)
* Fix mime-type in elf binaries by making sure $x is set
* Fix indirect negative offsets broken by OFFNEGATIVE
* Fix GUID equality check
* PR/165: Handle empty array and strings in JSON
* PR/162: Add --exclude-quiet
2020-06-06 15:33 Christos Zoulas <christos@zoulas.com>
* Fix memory leak in ascmagic (Steve Grubb)
2020-06-04 00:21 Christos Zoulas <christos@zoulas.com>
* Fix string comparison length with ignore whitespace
2020-05-31 00:11 Christos Zoulas <christos@zoulas.com>
* Fix mingwin 64 compilation
2020-05-30 23:56 Christos Zoulas <christos@zoulas.com>
* PR/159: whitelist getpid needed for file_pipe2file()
2020-05-09 18:57 Christos Zoulas <christos@zoulas.com>
* Indicate negative offsets with a flag OFFNEGATIVE
so that -0 works.
* Introduce "offset" magic type that can be used to
detect the file size, and bail on short files.
* document DER better in the magic man page.
2020-03-11 21:53 Christos Zoulas <christos@zoulas.com>
* fix memory leaks (SonarQube)
2020-03-08 21:33 Christos Zoulas <christos@zoulas.com>
* fix memory leaks (SonarQube)
* rewrite confusing loops (SonarQube)
* fix bogus test (SonarQube)
* pass a sized buffer to file_fmttime() (SonarQube)
* fix memory leaks (SonarQube)
2020-02-20 15:50 Christos Zoulas <christos@zoulas.com>
* Don't allow * in printf formats, or the code itself (Christoph Biedl)
* Introduce a printf output size checker to avoid DoS attacks
2020-02-17 17:22 Christos Zoulas <christos@zoulas.com>
* Avoid memory leak on error (oss-fuzz)
* Check length of string on DER before derefercing and add new types
* Add missing DER string (oss-fuzz)
2020-02-16 20:45 Christos Zoulas <christos@zoulas.com>
* Add missing DER types, and debugging
2020-02-13 13:10 Christos Zoulas <christos@zoulas.com>
* PR/140: Avoid abort with hand-crafted magic file (gockelhahn)
* PR/139 Avoid DoS in printf with hand-crafted magic file (gockelhahn)
* PR/138: Avoid crash with hand-crafted magic file (gockelhahn)
2020-02-12 17:30 Christos Zoulas <christos@zoulas.com>
* PR/136: Fix static build by adding a libmagic.pc (Fabrice Fontaine)
2019-12-24 14:16 Christos Zoulas <christos@zoulas.com>
* add guid support
2019-12-16 21:11 Christos Zoulas <christos@zoulas.com>
* release 5.38
2019-12-15 22:13 Christos Zoulas <christos@zoulas.com>
Document changes since the previous release:
- Always accept -S (no sandbox) even if we don't support sandboxing
- More syscalls elided for sandboxiing
- For ELF dynamic means having an interpreter not just PT_DYNAMIC
- Check for large ELF session header offset
- When saving and restoring a locale, keep the locale name in our
own storage.
- Add a flag to disable CSV file detection.
- Don't pass NULL/0 to memset to appease sanitizers.
- Avoid spurious prints when looks for extensions or apple strings
in fsmagic.
- Add builtin decompressors for xz and and bzip.
- Add a limit for the number of CDF elements.
- More checks for overflow in CDF.
2019-05-14 22:26 Christos Zoulas <christos@zoulas.com>
* release 5.37
2019-05-09 22:27 Christos Zoulas <christos@zoulas.com>
* Make sure that continuation separators are printed
with -k within softmagic
2019-05-06 22:27 Christos Zoulas <christos@zoulas.com>
* Change SIGPIPE saving and restoring during compression to use
sigaction(2) instead of signal(3) and cache it. (Denys Vlasenko)
* Cache stat(2) calls more to reduce number of calls (Denys Vlasenko)
2019-05-06 17:25 Christos Zoulas <christos@zoulas.com>
* PR/77: Handle --mime-type and -k correctly.
2019-05-03 15:26 Christos Zoulas <christos@zoulas.com>
* Switch decompression code to use vfork() because
tools like rpmdiff and rpmbuild call libmagic
with large process footprints (Denys Vlasenko)
2019-04-07 14:05 Christos Zoulas <christos@zoulas.com>
* PR/75: --enable-zlib, did not work.
2019-02-27 11:54 Christos Zoulas <christos@zoulas.com>
* Improve regex efficiency (Michael Schroeder) by:
1. Prefixing regex searches with regular search
for keywords where possible
2. Using memmem(3) where available
2019-02-20 10:16 Christos Zoulas <christos@zoulas.com>
* release 5.36
2019-02-19 15:30 Christos Zoulas <christos@zoulas.com>
* Fix cast to use cast macros
* Add UCS-32 builtin detection (PR/61) reported by tmc
2019-02-18 18:24 Christos Zoulas <christos@zoulas.com>
* Fix stack read (PR/62) and write (PR/64) stack overflows
reported by spinpx
2018-10-18 19:32 Christos Zoulas <christos@zoulas.com>
* release 5.35
2018-09-10 20:38 Christos Zoulas <christos@zoulas.com>
* Add FreeBSD ELF core file support (John Baldwin)
2018-08-20 18:40 Christos Zoulas <christos@zoulas.com>
* PR/30: Allow all parameter values to be set (don't treat 0 specially)
* handle default annotations on the softmagic match instead at the
end.
2018-07-25 10:17 Christos Zoulas <christos@zoulas.com>
* PR/23: Recognize JSON files
2018-07-25 10:17 Christos Zoulas <christos@zoulas.com>
* PR/18: file --mime-encoding should not print mime-type
2018-07-25 8:50 Christos Zoulas <christos@zoulas.com>
* release 5.34
2018-06-22 16:38 Christos Zoulas <christos@zoulas.com>
* Add Quad indirect offsets
2018-05-24 14:10 Christos Zoulas <christos@zoulas.com>
* Enable parsing of ELF dynamic sections to handle PIE better
2018-04-15 14:52 Christos Zoulas <christos@zoulas.com>
* release 5.33
2018-02-24 14:50 Christos Zoulas <christos@zoulas.com>
* extend the support for ${x?:} expansions for magic descriptions
2018-02-21 16:25 Christos Zoulas <christos@zoulas.com>
* add support for ${x?:} in mime types to handle
pie binaries.
2017-11-03 9:23 Christos Zoulas <christos@zoulas.com>
* add support for negative offsets (offsets from the end of file)
2017-09-26 8:22 Christos Zoulas <christos@zoulas.com>
* close the file on error when writing magic (Steve Grubb)
2017-09-24 12:02 Christos Zoulas <christos@zoulas.com>
* seccomp support (Paul Moore)
2017-09-02 11:53 Christos Zoulas <christos@zoulas.com>
* release 5.32
2017-08-28 16:37 Christos Zoulas <christos@zoulas.com>
* Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
2017-08-27 03:55 Christos Zoulas <christos@zoulas.com>
* Fix always true condition (Thomas Jarosch)
2017-05-24 17:30 Christos Zoulas <christos@zoulas.com>
* pickier parsing of numeric values in magic files.
2017-05-23 17:55 Christos Zoulas <christos@zoulas.com>
* PR/615 add magic_getflags()
2017-05-23 13:55 Christos Zoulas <christos@zoulas.com>
* release 5.31
2017-03-17 20:32 Christos Zoulas <christos@zoulas.com>
* remove trailing spaces from magic files
* refactor is_tar
* better bounds checks for cdf
2017-02-10 12:24 Christos Zoulas <christos@zoulas.com>
* release 5.30
2017-02-07 23:27 Christos Zoulas <christos@zoulas.com>
* If we exceeded the offset in a search return no match
(Christoph Biedl)
* Be more lenient on corrupt CDF files (Christoph Biedl)
2017-02-04 16:46 Christos Zoulas <christos@zoulas.com>
* pacify ubsan sign extension (oss-fuzz/524)
2017-02-01 12:42 Christos Zoulas <christos@zoulas.com>
* off by one in cdf parsing (PR/593)
* report debugging sections in elf (PR/591)
2016-11-06 10:52 Christos Zoulas <christos@zoulas.com>
* Allow @@@ in extensions
* Add missing overflow check in der magic (Jonas Wagner)
2016-10-25 10:40 Christos Zoulas <christos@zoulas.com>
* release 5.29
2016-10-24 11:20 Christos Zoulas <christos@zoulas.com>
* der getlength overflow (Jonas Wagner)
* multiple magic file load failure (Christoph Biedl)
2016-10-17 11:26 Christos Zoulas <christos@zoulas.com>
* CDF parsing improvements (Guy Helmer)
2016-07-20 7:26 Christos Zoulas <christos@zoulas.com>
* Add support for signed indirect offsets
2016-07-18 7:41 Christos Zoulas <christos@zoulas.com>
* cat /dev/null | file - should print empty (Christoph Biedl)
2016-07-05 15:20 Christos Zoulas <christos@zoulas.com>
* Bump string size from 64 to 96.
2016-06-13 20:20 Christos Zoulas <christos@zoulas.com>
* PR/556: Fix separators on annotations.
2016-06-13 19:40 Christos Zoulas <christos@zoulas.com>
* release 5.28
* fix leak on allocation failure
2016-06-01 1:20 Christos Zoulas <christos@zoulas.com>
* PR/555: Avoid overflow for offset > nbytes
* PR/550: Segv on DER parsing:
- use the correct variable for length
- set offset to 0 on failure.
2016-05-13 12:00 Christos Zoulas <christos@zoulas.com>
* release 5.27
2016-04-18 9:35 Christos Zoulas <christos@zoulas.com>
* Errors comparing DER entries or computing offsets
are just indications of malformed non-DER files.
Don't print them.
* Offset comparison was off-by-one.
* Fix compression code (Werner Fink)
* Put new bytes constant in the right file (not the generated one)
2016-04-16 18:34 Christos Zoulas <christos@zoulas.com>
* release 5.26
2016-03-31 13:50 Christos Zoulas <christos@zoulas.com>
* make the number of bytes read from files configurable.
2016-03-21 13:40 Christos Zoulas <christos@zoulas.com>
* Add bounds checks for DER code (discovered by Thomas Jarosch)
* Change indirect recursion limit to indirect use count and
bump from 15 to 50 to prevent abuse.
2016-03-13 20:39 Christos Zoulas <christos@zoulas.com>
* Add -00 which prints filename\0description\0
2016-03-01 13:28 Christos Zoulas <christos@zoulas.com>
* Fix ID3 indirect parsing
2016-01-19 10:18 Christos Zoulas <christos@zoulas.com>
* add DER parsing capability
2015-11-13 10:35 Christos Zoulas <christos@zoulas.com>
* provide dprintf(3) for the OS's that don't have it.
2015-11-11 16:25 Christos Zoulas <christos@zoulas.com>
* redo the compression code report decompression errors
2015-11-10 23:25 Christos Zoulas <christos@zoulas.com>
* REG_STARTEND code is not working as expected, delete it.
2015-11-09 16:05 Christos Zoulas <christos@zoulas.com>
* Add zlib support if we have it.
2015-11-05 11:22 Christos Zoulas <christos@zoulas.com>
* PR/492: compression forking was broken with magic_buffer.
2015-09-16 9:50 Christos Zoulas <christos@zoulas.com>
* release 5.25
2015-09-11 13:25 Christos Zoulas <christos@zoulas.com>
* add a limit to the length of regex searches
2015-09-08 9:50 Christos Zoulas <christos@zoulas.com>
* fix problems with --parameter (Christoph Biedl)
2015-07-11 10:35 Christos Zoulas <christos@zoulas.com>
* Windows fixes PR/466 (Jason Hood)
2015-07-09 10:35 Christos Zoulas <christos@zoulas.com>
* release 5.24
2015-06-11 8:52 Christos Zoulas <christos@zoulas.com>
* redo long option encoding to fix off-by-one in 5.23
2015-06-10 13:50 Christos Zoulas <christos@zoulas.com>
* release 5.23
2015-06-09 16:10 Christos Zoulas <christos@zoulas.com>
* Fix issue with regex range for magic with offset
* Always return true from mget with USE (success to mget not match
indication). Fixes mime evaluation after USE magic
* PR/459: Don't insert magic entries to the list if there are parsing
errors for them.
2015-06-03 16:00 Christos Zoulas <christos@zoulas.com>
* PR/455: Add utf-7 encoding
2015-06-03 14:30 Christos Zoulas <christos@zoulas.com>
* PR/455: Implement -Z, look inside, but don't report on compression
* PR/454: Fix allocation error on bad magic.
2015-05-29 10:30 Christos Zoulas <christos@zoulas.com>
* handle MAGIC_CONTINUE everywhere, not just in softmagic
2015-05-21 14:30 Christos Zoulas <christos@zoulas.com>
* don't print descriptions for NAME types when mime.
2015-04-09 15:59 Christos Zoulas <christos@zoulas.com>
* Add --extension to list the known extensions for this file type
Idea by Andrew J Roazen
2015-02-14 12:23 Christos Zoulas <christos@zoulas.com>
* Bump file search buffer size to 1M.
2015-01-09 14:35 Christos Zoulas <christos@zoulas.com>
* Fix multiple issues with date formats reported by Christoph Biedl:
- T_LOCAL meaning was reversed
- Arithmetic did not work
Also stop adjusting daylight savings for gmt printing.
2015-01-05 13:00 Christos Zoulas <christos@zoulas.com>
* PR/411: Fix memory corruption from corrupt cdf file.
2015-01-02 15:15 Christos Zoulas <christos@zoulas.com>
* release 5.22
2015-01-01 12:01 Christos Zoulas <christos@zoulas.com>
* add indirect relative for TIFF/Exif
2014-12-16 18:10 Christos Zoulas <christos@zoulas.com>
* restructure elf note printing to avoid repeated messages
* add note limit, suggested by Alexander Cherepanov
2014-12-16 16:53 Christos Zoulas <christos@zoulas.com>
* Bail out on partial pread()'s (Alexander Cherepanov)
* Fix incorrect bounds check in file_printable (Alexander Cherepanov)
2014-12-11 20:01 Christos Zoulas <christos@zoulas.com>
* PR/405: ignore SIGPIPE from uncompress programs
* change printable -> file_printable and use it in
more places for safety
* in ELF, instead of "(uses dynamic libraries)" when PT_INTERP
is present print the interpreter name.
2014-12-10 20:01 Christos Zoulas <christos@zoulas.com>
* release 5.21
2014-11-27 18:40 Christos Zoulas <christos@zoulas.com>
* Allow setting more parameters from the command line.
* Split name/use and indirect magic recursion limits.
2014-11-27 11:12 Christos Zoulas <christos@zoulas.com>
* Adjust ELF parameters and the default recursion
level.
* Allow setting the recursion level dynamically.
2014-11-24 8:55 Christos Zoulas <christos@zoulas.com>
* The following fixes resulted from Thomas Jarosch's fuzzing
tests that revealed severe performance issues on pathological
input:
- limit number of elf program and sections processing
- abort elf note processing quickly
- reduce the number of recursion levels from 20 to 10
- preserve error messages in indirect magic handling
This is tracked as CVE-2014-8116 and CVE-2014-8117
2014-11-12 10:30 Christos Zoulas <christos@zoulas.com>
* fix bogus free in the user buffer case.
2014-11-11 12:35 Christos Zoulas <christos@zoulas.com>
* fix out of bounds read for pascal strings
* fix memory leak (not freeing the head of each mlist)
2014-11-07 10:25 Christos Zoulas <christos@zoulas.com>
* When printing strings from a file, convert them to printable
on a byte by byte basis, so that we don't get issues with
locale's trying to interpret random byte streams as UTF-8 and
having printf error out with EILSEQ.
2014-10-17 11:48 Christos Zoulas <christos@zoulas.com>
* fix bounds in note reading (Francisco Alonso / Red Hat)
2014-10-11 15:02 Christos Zoulas <christos@zoulas.com>
* fix autoconf glue for setlocale and locale_t; some OS's
have locale_t in xlocale.h
2014-10-10 15:01 Christos Zoulas <christos@zoulas.com>
* release 5.20
2014-08-17 10:01 Christos Zoulas <christos@zoulas.com>
* recognize encrypted CDF documents
2014-08-04 9:18 Christos Zoulas <christos@zoulas.com>
* add magic_load_buffers from Brooks Davis
2014-07-24 16:40 Christos Zoulas <christos@zoulas.com>
* add thumbs.db support
2014-06-12 12:28 Christos Zoulas <christos@zoulas.com>
* release 5.19
2014-06-09 9:04 Christos Zoulas <christos@zoulas.com>
* Misc buffer overruns and missing buffer size tests in cdf parsing
(Francisco Alonso, Jan Kaluza)
2014-06-02 14:50 Christos Zoulas <christos@zoulas.com>
* Enforce limit of 8K on regex searches that have no limits
* Allow the l modifier for regex to mean line count. Default
to byte count. If line count is specified, assume a max
of 80 characters per line to limit the byte count.
* Don't allow conversions to be used for dates, allowing
the mask field to be used as an offset.
2014-05-30 12:51 Christos Zoulas <christos@zoulas.com>
* Make the range operator limit the length of the
regex search.
2014-05-14 19:23 Christos Zoulas <christos@zoulas.com>
* PR/347: Windows fixes
* PR/352: Hangul word processor recognition
* PR/354: Encoding irregularities in text files
2014-05-06 6:12 Christos Zoulas <christos@zoulas.com>
* Fix uninitialized title in CDF files (Jan Kaluza)
2014-05-04 14:55 Christos Zoulas <christos@zoulas.com>
* PR/351: Fix compilation of empty files
2014-04-30 17:39 Christos Zoulas <christos@zoulas.com>
* Fix integer formats: We don't specify 'l' or
'h' and 'hh' specifiers anymore, only 'll' for
quads and nothing for the rest. This is so that
magic writing is simpler.
2014-04-01 15:25 Christos Zoulas <christos@zoulas.com>
* PR/341: Jan Kaluza, fix memory leak
* PR/342: Jan Kaluza, fix out of bounds read
2014-03-28 15:25 Christos Zoulas <christos@zoulas.com>
* Fix issue with long formats not matching fmtcheck
2014-03-26 11:25 Christos Zoulas <christos@zoulas.com>
* release 5.18
2014-03-15 17:45 Christos Zoulas <christos@zoulas.com>
* add fmtcheck(3) for those who don't have it
2014-03-14 15:12 Christos Zoulas <christos@zoulas.com>
* prevent mime entries from being attached to magic
entries with no descriptions
* adjust magic strength for regex type
* remove superfluous ascmagic with encoding test
2014-03-06 12:01 Christos Zoulas <christos@zoulas.com>
* fix regression fix echo -ne "\012\013\014" | file -i -
which printed "binary" instead of "application/octet-stream"
* add size_t overflow check for magic file size
2014-02-27 16:01 Christos Zoulas <christos@zoulas.com>
* experimental support for matching with CFD CLSID
2014-02-18 13:04 Kimmo Suominen (kimmo@suominen.com)
* Cache old LC_CTYPE locale before setting it to "C", so
we can use it to restore LC_CTYPE instead of asking
setlocale() to scan the environment variables.
2014-02-12 18:21 Christos Zoulas <christos@zoulas.com>
* Count recursion levels through indirect magic
2014-02-11 10:40 Christos Zoulas <christos@zoulas.com>
* Prevent infinite recursion on files with indirect offsets of 0
2014-01-30 21:00 Christos Zoulas <christos@zoulas.com>
* Add -E flag that makes file print filesystem errors to stderr
and exit.
2014-01-08 17:20 Christos Zoulas <christos@zoulas.com>
* mime printing could print results from multiple magic entries
if there were multiple matches.
* in some cases overflow was not detected when computing offsets
in softmagic.
2013-12-05 12:00 Christos Zoulas <christos@zoulas.com>
* use strcasestr() to for cdf strings
* reset to the "C" locale while doing regex operations, or case
insensitive comparisons; this is provisional
2013-11-19 20:10 Christos Zoulas <christos@zoulas.com>
* always leave magic file loaded, don't unload for magic_check, etc.
* fix default encoding to binary instead of unknown which broke recently
* handle empty and one byte files, less specially so that
--mime-encoding does not break completely.
`
2013-11-06 14:40 Christos Zoulas <christos@zoulas.com>
* fix erroneous non-zero exit code from non-existent file and message
2013-10-29 14:25 Christos Zoulas <christos@zoulas.com>
* add CDF MSI file detection (Guy Helmer)
2013-09-03 11:56 Christos Zoulas <christos@zoulas.com>
* Don't mix errors and regular output if there was an error
* in magic_descriptor() don't close the file and try to restore
its position
2013-05-30 17:25 Christos Zoulas <christos@zoulas.com>
* Don't treat magic as an error if offset was past EOF (Christoph Biedl)
2013-05-28 17:25 Christos Zoulas <christos@zoulas.com>
* Fix spacing issues in softmagic and elf (Jan Kaluza)
2013-05-02 18:00 Christos Zoulas <christos@zoulas.com>
* Fix segmentation fault with multiple magic_load commands.
2013-04-22 11:20 Christos Zoulas <christos@zoulas.com>
* The way "default" was implemented was not very useful
because the "if something was printed at that level"
was not easily controlled by the user, and the format
was bound to a string which is too restrictive. Add
a "clear" for that level keyword and make "default"
void. This way one can do:
>>13 clear x
>>13 lelong 1 foo
>>13 lelong 2 bar
>>13 default x
>>>13 lelong x unknown %x
2013-03-25 13:20 Christos Zoulas <christos@zoulas.com>
* disallow strength setting in "name" entries
2013-03-06 21:24 Christos Zoulas <christos@zoulas.com>
* fix recursive magic separator printing
2013-02-26 19:28 Christos Zoulas <christos@zoulas.com>
* limit recursion level for mget
* fix pread() related breakage in cdf
* handle offsets properly in recursive "use"
2013-02-18 10:39 Christos Zoulas <christos@zoulas.com>
* add elf reading of debug info to determine if file is stripped
(Jan Kaluza)
* use pread()
2013-01-25 18:05 Christos Zoulas <christos@zoulas.com>
* change mime description size from 64 to 80 to accommodate OOXML.
2013-01-11 14:50 Christos Zoulas <christos@zoulas.com>
* Warn about inconsistent continuation levels.
* Change fsmagic to add a space after it prints.
2013-01-10 21:00 Christos Zoulas <christos@zoulas.com>
* Make getline public so that file can link against it.
Perhaps it is better to rename it, or hide it differently.
Fixes builds on platforms that do not provide it.
2013-01-07 16:30 Christos Zoulas <christos@zoulas.com>
* Add SuS d{,1,2,4,8}, u{,1,2,4,8} and document
what long, int, short, etc is (Guy Harris)
2013-01-06 11:20 Christos Zoulas <christos@zoulas.com>
* add magic_version function and constant
* Redo memory allocation and de-allocation.
(prevents double frees on non mmap platforms)
* Fix bug with name/use having to do with passing
found state from the parent to the child and back.
2012-12-19 8:47 Christos Zoulas <christos@zoulas.com>
* Only print elf capabilities for archs we know (Jan Kaluza)
2012-10-30 19:14 Christos Zoulas <christos@zoulas.com>
* Add "name" and "use" file types in order to look
inside mach-o files.
2012-09-06 10:40 Christos Zoulas <christos@zoulas.com>
* make --version exit 0 (Matthew Schultz)
* add string/T (Jan Kaluza)
2012-08-09 2:15 Christos Zoulas <christos@zoulas.com>
* add z and t modifiers for our own vasprintf
* search for $HOME/.magic.mgc if it is there first
* fix reads from a pipe, and preserve errno
2012-05-15 13:12 Christos Zoulas <christos@zoulas.com>
* use ctime_r, asctime_r
2012-04-06 17:18 Christos Zoulas <christos@zoulas.com>
* Fixes for indirect offsets to handle apple disk formats
2012-04-03 18:26 Christos Zoulas <christos@zoulas.com>
* Add windows date field types
* More info for windows shortcuts (incomplete)
2012-02-20 17:33 Christos Zoulas <christos@zoulas.com>
* Fix CDF parsing issues found by CERT's fuzzing tool (Will Dormann)
2011-12-15 12:17 Chris Metcalf <cmetcalf@tilera.com>
* Support Tilera architectures (tile64, tilepro, tilegx).
2011-12-16 16:33 Reuben Thomas <rrt@sc3d.org>
* Add magic for /usr/bin/env Perl scripts
* Weaken generic script magic to avoid clashing with
language-specific magic.
2011-12-08 13:37 Reuben Thomas <rrt@sc3d.org>
* Simplify if (p) free(p) to free(p).
2011-12-08 13:07 Reuben Thomas <rrt@sc3d.org>
* Remove hardwired token finding (names.h), turning it into soft
magic. Patterns are either anchored regexs or search/8192. English
language detection and PL/1 detection have been removed as they
were too fragile. -e tokens is still accepted for backwards
compatibility.
* Move 3ds patterns (which are commented out anyway) into autodesk
(they were, oddly, in c-lang).
2011-12-06 00:16 Reuben Thomas <rrt@sc3d.org>
* Tweak strength of generic hash-bang detectors to be less than
specific ones.
* Make an inconsistent description of Python scripts consistent.
2011-12-05 23:58 Reuben Thomas <rrt@sc3d.org>
* Fix minor error in file(1).
2011-11-05 00:00 Reuben Thomas <rrt@sc3d.org>
* Fix issue #150 (I hope).
2011-09-22 12:57 Christos Zoulas <christos@zoulas.com>
* Python3 binding fixes from Kelly Anderson
2011-09-20 11:32 Christos Zoulas <christos@zoulas.com>
* If a string type magic entry is marked as text or binary
only match text files against text entries and binary
files against binary entries.
2011-09-01 12:12 Christos Zoulas <christos@zoulas.com>
* Don't wait for any subprocess, just the one we forked.
2011-08-26 16:40 Christos Zoulas <christos@zoulas.com>
* If the application name is not set in a cdf file, try to see
if it has a directory with the application name on it.
2011-08-17 14:32 Christos Zoulas <christos@zoulas.com>
* Fix ELF lseek(2) madness. Inspired by PR/134 by Jan Kaluza
2011-08-14 09:03 Christos Zoulas <christos@zoulas.com>
* Don't use variable string formats.
2011-07-12 12:32 Reuben Thomas <rrt@sc3d.org>
* Fix detection of Zip files (Mantis #128).
* Make some minor improvements to file(1).
* Rename MIME types for filesystem objects for consistency with
xdg-utils. Typically this means that application/x-foo becomes
inode/foo, but some names also change slightly, e.g.
application/x-character-device becomes inode/chardevice.
2011-05-10 20:57 Christos Zoulas <christos@zoulas.com>
* fix mingw compilation (Abradoks)
2011-05-10 20:57 Christos Zoulas <christos@zoulas.com>