php/sme8/php-5.3.3-CVE-2014-0237.patch

Patch for PHP 5.3.3 adapted from:

From 68ce2d0ea6da79b12a365e375e1c2ce882c77480 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Mon, 26 May 2014 17:50:14 -0700
Subject: [PATCH] Fix bug #67328 (fileinfo: numerous file_printf calls
 resulting in performance degradation)

Upstream patch: https://github.com/file/file/commit/b8acc83781d5a24cc5101e525d15efe0482c280d
---
 ext/fileinfo/libmagic/cdf.c | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
index dd7177e..8dacd2f 100644
--- a/ext/fileinfo/libmagic/cdf.c
+++ b/ext/fileinfo/libmagic/cdf.c
@@ -854,7 +854,7 @@ int
 cdf_unpack_summary_info(const cdf_stream_t *sst, cdf_summary_info_header_t *ssi,
     cdf_property_info_t **info, size_t *count)
 {
-       size_t i, maxcount;
+       size_t maxcount;
        const cdf_summary_info_header_t *si = sst->sst_tab;
        const cdf_section_declaration_t *sd = (const void *)
            ((const char *)sst->sst_tab + CDF_SECTION_DECLARATION_OFFSET);
@@ -867,20 +867,13 @@ cdf_unpack_summary_info(const cdf_stream
        ssi->si_os = CDF_TOLE2(si->si_os);
        ssi->si_class = si->si_class;
        cdf_swap_class(&ssi->si_class);
-       ssi->si_count = CDF_TOLE2(si->si_count);
+       ssi->si_count = CDF_TOLE4(si->si_count);
        *count = 0;
        maxcount = 0;
        *info = NULL;
-       for (i = 0; i < CDF_TOLE4(si->si_count); i++) {
-               if (i >= CDF_LOOP_LIMIT) {
-                       DPRINTF(("Unpack summary info loop limit"));
-                       errno = EFTYPE;
-                       return -1;
-               }
-               if (cdf_read_property_info(sst, CDF_TOLE4(sd->sd_offset),
-                   info, count, &maxcount) == -1)
-                       return -1;
-       }
+       if (cdf_read_property_info(sst, CDF_TOLE4(sd->sd_offset),
+           info, count, &maxcount) == -1)
+               return -1;
        return 0;
 }
 
-- 
1.9.2

1	Patch for PHP 5.3.3 adapted from:
2
3	From 68ce2d0ea6da79b12a365e375e1c2ce882c77480 Mon Sep 17 00:00:00 2001
4	From: Stanislav Malyshev <stas@php.net>
5	Date: Mon, 26 May 2014 17:50:14 -0700
6	Subject: [PATCH] Fix bug #67328 (fileinfo: numerous file_printf calls
7	resulting in performance degradation)
8
9	Upstream patch: https://github.com/file/file/commit/b8acc83781d5a24cc5101e525d15efe0482c280d
10	---
11	ext/fileinfo/libmagic/cdf.c \| 16 ++++------------
12	1 file changed, 4 insertions(+), 12 deletions(-)
13
14	diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
15	index dd7177e..8dacd2f 100644
16	--- a/ext/fileinfo/libmagic/cdf.c
17	+++ b/ext/fileinfo/libmagic/cdf.c
18	@@ -854,7 +854,7 @@ int
19	cdf_unpack_summary_info(const cdf_stream_t sst, cdf_summary_info_header_t ssi,
20	cdf_property_info_t *info, size_t count)
21	{
22	- size_t i, maxcount;
23	+ size_t maxcount;
24	const cdf_summary_info_header_t *si = sst->sst_tab;
25	const cdf_section_declaration_t sd = (const void )
26	((const char *)sst->sst_tab + CDF_SECTION_DECLARATION_OFFSET);
27	@@ -867,20 +867,13 @@ cdf_unpack_summary_info(const cdf_stream
28	ssi->si_os = CDF_TOLE2(si->si_os);
29	ssi->si_class = si->si_class;
30	cdf_swap_class(&ssi->si_class);
31	- ssi->si_count = CDF_TOLE2(si->si_count);
32	+ ssi->si_count = CDF_TOLE4(si->si_count);
33	*count = 0;
34	maxcount = 0;
35	*info = NULL;
36	- for (i = 0; i < CDF_TOLE4(si->si_count); i++) {
37	- if (i >= CDF_LOOP_LIMIT) {
38	- DPRINTF(("Unpack summary info loop limit"));
39	- errno = EFTYPE;
40	- return -1;
41	- }
42	- if (cdf_read_property_info(sst, CDF_TOLE4(sd->sd_offset),
43	- info, count, &maxcount) == -1)
44	- return -1;
45	- }
46	+ if (cdf_read_property_info(sst, CDF_TOLE4(sd->sd_offset),
47	+ info, count, &maxcount) == -1)
48	+ return -1;
49	return 0;
50	}
51
52	--
53	1.9.2
54