11diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
22--- libmagic.orig/apprentice.c 2018-03-11 01:46:42.000000000 +0100
3- +++ libmagic/apprentice.c 2019-04-11 15:17:54.486688613 +0200
3+ +++ libmagic/apprentice.c 2019-04-12 10:04:15.721646341 +0200
44@@ -2,7 +2,7 @@
55 * Copyright (c) Ian F. Darwin 1986-1995.
66 * Software written by Ian F. Darwin and others;
@@ -1400,7 +1400,7 @@ diff -u libmagic.orig/buffer.c libmagic/buffer.c
14001400
14011401diff -u libmagic.orig/cdf.c libmagic/cdf.c
14021402--- libmagic.orig/cdf.c 2018-03-11 01:46:42.000000000 +0100
1403- +++ libmagic/cdf.c 2019-03-08 09:31:16.392796494 +0100
1403+ +++ libmagic/cdf.c 2019-04-12 12:02:54.279893504 +0200
14041404@@ -43,7 +43,17 @@
14051405 #include <err.h>
14061406 #endif
@@ -1469,7 +1469,19 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
14691469 scn->sst_tab = NULL;
14701470 return -1;
14711471 }
1472- @@ -336,12 +318,13 @@
1472+ @@ -311,9 +293,11 @@
1473+ static size_t
1474+ cdf_check_stream(const cdf_stream_t *sst, const cdf_header_t *h)
1475+ {
1476+ + #ifndef NDEBUG
1477+ size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
1478+ CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
1479+ assert(ss == sst->sst_ss);
1480+ + #endif
1481+ return sst->sst_ss;
1482+ }
1483+
1484+ @@ -336,12 +320,13 @@
14731485 }
14741486
14751487 static ssize_t
@@ -1485,7 +1497,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
14851497
14861498 if (info->i_buf != NULL && info->i_len >= siz) {
14871499 (void)memcpy(buf, &info->i_buf[off], len);
1488- @@ -351,7 +334 ,10 @@
1500+ @@ -351,7 +336 ,10 @@
14891501 if (info->i_fd == -1)
14901502 goto out;
14911503
@@ -1497,7 +1509,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
14971509 return -1;
14981510
14991511 return (ssize_t)len;
1500- @@ -366,7 +352 ,7 @@
1512+ @@ -366,7 +354 ,7 @@
15011513 char buf[512];
15021514
15031515 (void)memcpy(cdf_bo.s, "\01\02\03\04", 4);
@@ -1506,15 +1518,29 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
15061518 return -1;
15071519 cdf_unpack_header(h, buf);
15081520 cdf_swap_header(h);
1509- @@ -400,7 +386,7 @@
1510- size_t ss = CDF_SEC_SIZE(h);
1521+ @@ -397,19 +385,17 @@
1522+ cdf_read_sector(const cdf_info_t *info, void *buf, size_t offs, size_t len,
1523+ const cdf_header_t *h, cdf_secid_t id)
1524+ {
1525+ - size_t ss = CDF_SEC_SIZE(h);
15111526 size_t pos = CDF_SEC_POS(h, id);
1512- assert(ss == len);
1527+ - assert(ss == len);
15131528- return cdf_read(info, (off_t)pos, ((char *)buf) + offs, len);
1529+ + assert(CDF_SEC_SIZE(h) == len);
15141530+ return cdf_read(info, (zend_off_t)pos, ((char *)buf) + offs, len);
15151531 }
15161532
15171533 ssize_t
1534+ cdf_read_short_sector(const cdf_stream_t *sst, void *buf, size_t offs,
1535+ size_t len, const cdf_header_t *h, cdf_secid_t id)
1536+ {
1537+ - size_t ss = CDF_SHORT_SEC_SIZE(h);
1538+ size_t pos = CDF_SHORT_SEC_POS(h, id);
1539+ - assert(ss == len);
1540+ + assert(CDF_SHORT_SEC_SIZE(h) == len);
1541+ if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) {
1542+ DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %"
1543+ SIZE_T_FORMAT "u\n",
15181544@@ -501,14 +487,14 @@
15191545 }
15201546 out:
@@ -1731,7 +1757,7 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
17311757 (void)snprintf(buf, 26, "*Bad* %#16.16" INT64_T_FORMAT "x\n",
17321758diff -u libmagic.orig/compress.c libmagic/compress.c
17331759--- libmagic.orig/compress.c 2017-11-02 21:25:39.000000000 +0100
1734- +++ libmagic/compress.c 2019-04-11 15:16:47.060067956 +0200
1760+ +++ libmagic/compress.c 2019-04-12 10:04:15.721646341 +0200
17351761@@ -2,7 +2,7 @@
17361762 * Copyright (c) Ian F. Darwin 1986-1995.
17371763 * Software written by Ian F. Darwin and others;
@@ -3212,7 +3238,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
32123238
32133239diff -u libmagic.orig/magic.c libmagic/magic.c
32143240--- libmagic.orig/magic.c 2017-08-28 15:39:18.000000000 +0200
3215- +++ libmagic/magic.c 2019-04-11 15:19:30.857295866 +0200
3241+ +++ libmagic/magic.c 2019-04-12 10:04:15.721646341 +0200
32163242@@ -25,11 +25,6 @@
32173243 * SUCH DAMAGE.
32183244 */
0 commit comments