Attachment 26614 Details for Bug 63576

Security update for file-4.07

file-4.07-security.dif (text/plain), 2.43 KB, created by Dr. Werner Fink on 2004-12-01 01:49:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dr. Werner Fink

Created: 2004-12-01 01:49:32 UTC

Size: 2.43 KB

patch

obsolete

>--- src/readelf.c
>+++ src/readelf.c	Tue Nov 30 18:09:09 2004
>@@ -147,6 +147,9 @@
> 			    getu32(swap, ph32.p_align) : 4) \
> 			 : (off_t) (ph64.p_align ?	\
> 			    getu64(swap, ph64.p_align) : 4)))
>+#define ph_filesz	(class == ELFCLASS32		\
>+			 ? getu32(swap, ph32.p_filesz)	\
>+			 : getu64(swap, ph64.p_filesz))
> #define nh_size		(class == ELFCLASS32		\
> 			 ? sizeof nh32			\
> 			 : sizeof nh64)
>@@ -249,7 +252,7 @@
> 			file_badseek(ms);
> 			return -1;
> 		}
>-		bufsize = read(fd, nbuf, BUFSIZ);
>+		bufsize = read(fd, nbuf, ((ph_filesz < BUFSIZ) ? ph_filesz : BUFSIZ));
> 		if (bufsize == -1) {
> 			file_badread(ms);
> 			return -1;
>@@ -294,7 +297,7 @@
> 	noff = offset;
> 	doff = ELF_ALIGN(offset + nh_namesz);
> 
>-	if (offset + nh_namesz >= size) {
>+	if (offset + nh_namesz > size) {
> 		/*
> 		 * We're past the end of the buffer.
> 		 */
>@@ -302,7 +305,7 @@
> 	}
> 
> 	offset = ELF_ALIGN(doff + nh_descsz);
>-	if (offset + nh_descsz >= size)
>+	if (doff + nh_descsz > size)
> 		return offset;
> 
> 	if (nh_namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 &&
>@@ -622,7 +625,7 @@
> 				file_badseek(ms);
> 				return -1;
> 			}
>-			bufsize = read(fd, nbuf, sizeof(nbuf));
>+			bufsize = read(fd, nbuf, ((ph_filesz < BUFSIZ) ? ph_filesz : BUFSIZ));
> 			if (bufsize == -1) {
> 				file_badread(ms);
> 				return -1;
>@@ -634,7 +637,7 @@
> 				offset = donote(ms, nbuf, offset,
> 				    (size_t)bufsize, class, swap, ph_align);
> 			}
>-			if (lseek(fd, savedoffset + offset, SEEK_SET)
>+			if (lseek(fd, savedoffset, SEEK_SET)
> 			    == (off_t)-1) {
> 				file_badseek(ms);
> 				return -1;
>--- src/softmagic.c
>+++ src/softmagic.c	Tue Nov 30 18:06:13 2004
>@@ -427,27 +427,27 @@
> 		return 1;
> 	case FILE_STRING:
> 		{
>-			int n;
>+			size_t len;
> 
> 			/* Null terminate and eat *trailing* return */
> 			p->s[sizeof(p->s) - 1] = '\0';
>-			n = strlen(p->s) - 1;
>-			if (p->s[n] == '\n')
>-				p->s[n] = '\0';
>+			len = strlen(p->s);
>+			if (len-- && p->s[len] == '\n')
>+				p->s[len] = '\0';
> 			return 1;
> 		}
> 	case FILE_PSTRING:
> 		{
> 			char *ptr1 = p->s, *ptr2 = ptr1 + 1;
>-			unsigned int n = *p->s;
>-			if (n >= sizeof(p->s))
>-				n = sizeof(p->s) - 1;
>-			while (n--)
>+			size_t len = *p->s;
>+			if (len >= sizeof(p->s))
>+				len = sizeof(p->s) - 1;
>+			while (len--)
> 				*ptr1++ = *ptr2++;
> 			*ptr1 = '\0';
>-			n = strlen(p->s) - 1;
>-			if (p->s[n] == '\n')
>-				p->s[n] = '\0';
>+			len = strlen(p->s);
>+			if (len-- && p->s[len] == '\n')
>+				p->s[len] = '\0';
> 			return 1;
> 		}
> 	case FILE_BESHORT:

Actions: View

Attachments on bug 63576: 26516 | 26576 | 26577 | 26580 | 26581 | 26582 | 26583 | 26584 | 26602 | 26612 | 26613 | 26614 | 26615