php/sme8/php-5.3.3-CVE-2014-0237.patch

Patch for PHP 5.3.3 adapted from:

From 68ce2d0ea6da79b12a365e375e1c2ce882c77480 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Mon, 26 May 2014 17:50:14 -0700
Subject: [PATCH] Fix bug #67328 (fileinfo: numerous file_printf calls
 resulting in performance degradation)

Upstream patch: https://github.com/file/file/commit/b8acc83781d5a24cc5101e525d15efe0482c280d
---
 ext/fileinfo/libmagic/cdf.c | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
index dd7177e..8dacd2f 100644
--- a/ext/fileinfo/libmagic/cdf.c
+++ b/ext/fileinfo/libmagic/cdf.c
@@ -854,7 +854,7 @@ int
 cdf_unpack_summary_info(const cdf_stream_t *sst, cdf_summary_info_header_t *ssi,
     cdf_property_info_t **info, size_t *count)
 {
-       size_t i, maxcount;
+       size_t maxcount;
        const cdf_summary_info_header_t *si = sst->sst_tab;
        const cdf_section_declaration_t *sd = (const void *)
            ((const char *)sst->sst_tab + CDF_SECTION_DECLARATION_OFFSET);
@@ -867,20 +867,13 @@ cdf_unpack_summary_info(const cdf_stream
        ssi->si_os = CDF_TOLE2(si->si_os);
        ssi->si_class = si->si_class;
        cdf_swap_class(&ssi->si_class);
-       ssi->si_count = CDF_TOLE2(si->si_count);
+       ssi->si_count = CDF_TOLE4(si->si_count);
        *count = 0;
        maxcount = 0;
        *info = NULL;
-       for (i = 0; i < CDF_TOLE4(si->si_count); i++) {
-               if (i >= CDF_LOOP_LIMIT) {
-                       DPRINTF(("Unpack summary info loop limit"));
-                       errno = EFTYPE;
-                       return -1;
-               }
-               if (cdf_read_property_info(sst, CDF_TOLE4(sd->sd_offset),
-                   info, count, &maxcount) == -1)
-                       return -1;
-       }
+       if (cdf_read_property_info(sst, CDF_TOLE4(sd->sd_offset),
+           info, count, &maxcount) == -1)
+               return -1;
        return 0;
 }
 
-- 
1.9.2

1	vip-ire	1.1	Patch for PHP 5.3.3 adapted from:
2
3			From 68ce2d0ea6da79b12a365e375e1c2ce882c77480 Mon Sep 17 00:00:00 2001
4			From: Stanislav Malyshev <stas@php.net>
5			Date: Mon, 26 May 2014 17:50:14 -0700
6			Subject: [PATCH] Fix bug #67328 (fileinfo: numerous file_printf calls
7			resulting in performance degradation)
8
9			Upstream patch: https://github.com/file/file/commit/b8acc83781d5a24cc5101e525d15efe0482c280d
10			---
11			ext/fileinfo/libmagic/cdf.c \| 16 ++++------------
12			1 file changed, 4 insertions(+), 12 deletions(-)
13
14			diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
15			index dd7177e..8dacd2f 100644
16			--- a/ext/fileinfo/libmagic/cdf.c
17			+++ b/ext/fileinfo/libmagic/cdf.c
18			@@ -854,7 +854,7 @@ int
19			cdf_unpack_summary_info(const cdf_stream_t sst, cdf_summary_info_header_t ssi,
20			cdf_property_info_t *info, size_t count)
21			{
22			- size_t i, maxcount;
23			+ size_t maxcount;
24			const cdf_summary_info_header_t *si = sst->sst_tab;
25			const cdf_section_declaration_t sd = (const void )
26			((const char *)sst->sst_tab + CDF_SECTION_DECLARATION_OFFSET);
27			@@ -867,20 +867,13 @@ cdf_unpack_summary_info(const cdf_stream
28			ssi->si_os = CDF_TOLE2(si->si_os);
29			ssi->si_class = si->si_class;
30			cdf_swap_class(&ssi->si_class);
31			- ssi->si_count = CDF_TOLE2(si->si_count);
32			+ ssi->si_count = CDF_TOLE4(si->si_count);
33			*count = 0;
34			maxcount = 0;
35			*info = NULL;
36			- for (i = 0; i < CDF_TOLE4(si->si_count); i++) {
37			- if (i >= CDF_LOOP_LIMIT) {
38			- DPRINTF(("Unpack summary info loop limit"));
39			- errno = EFTYPE;
40			- return -1;
41			- }
42			- if (cdf_read_property_info(sst, CDF_TOLE4(sd->sd_offset),
43			- info, count, &maxcount) == -1)
44			- return -1;
45			- }
46			+ if (cdf_read_property_info(sst, CDF_TOLE4(sd->sd_offset),
47			+ info, count, &maxcount) == -1)
48			+ return -1;
49			return 0;
50			}
51
52			--
53			1.9.2
54