Skip to content

Commit 7ba1409

Browse files
remicolletsmalyshev
authored andcommitted
Fix bug #67716 - Segfault in cdf.c
1 parent fd28010 commit 7ba1409

File tree

2 files changed

+2
-1
lines changed

2 files changed

+2
-1
lines changed

Diff for: NEWS

+1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ PHP NEWS
88
- Fileinfo:
99
. Fixed bug #67705 (extensive backtracking in rule regular expression).
1010
(CVE-2014-3538) (Remi)
11+
. Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi)
1112

1213
- GD:
1314
. Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference).

Diff for: ext/fileinfo/libmagic/cdf.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -820,7 +820,7 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
820820
q = (const uint8_t *)(const void *)
821821
((const char *)(const void *)p + ofs
822822
- 2 * sizeof(uint32_t));
823-
if (q > e) {
823+
if (q < p || q > e) {
824824
DPRINTF(("Ran of the end %p > %p\n", q, e));
825825
goto out;
826826
}

0 commit comments

Comments
 (0)