php/sme8/php-5.3.3-CVE-2014-0238.patch

Patch for PHP 5.3.3 adapted from:

From 22736b7c56d678f142d5dd21f4996e5819507a2b Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Mon, 26 May 2014 17:42:18 -0700
Subject: [PATCH] Fix bug #67327: fileinfo: CDF infinite loop in nelements DoS

Upstream fix: https://github.com/file/file/commit/f97486ef5dc3e8735440edc4fc8808c63e1a3ef0
---
 ext/fileinfo/libmagic/cdf.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
index 8dacd2f..4712e84 100644
--- a/ext/fileinfo/libmagic/cdf.c
+++ b/ext/fileinfo/libmagic/cdf.c
@@ -760,6 +760,10 @@ cdf_read_property_info(const cdf_stream_
                    inp[i].pi_type, (const char *)q - (const char *)p));
                if (inp[i].pi_type & CDF_VECTOR) {
                        nelements = CDF_TOLE4(q[1]);
+                       if (nelements == 0) {
+                               DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+                               goto out;
+                       }                       
                        o = 2;
                } else {
                        nelements = 1;
@@ -815,7 +819,8 @@ cdf_read_property_info(const cdf_stream_
                                inp = *info + nelem;
                        }
                        DPRINTF(("nelements = %d\n", nelements));
-                       for (j = 0; j < nelements; j++, i++) {
+                       for (j = 0; j < nelements && i < sh.sh_properties;
+                            j++, i++) {
                                uint32_t l = CDF_TOLE4(q[o]);
                                inp[i].pi_str.s_len = l;
                                inp[i].pi_str.s_buf = (const char *)(&q[o+1]);
-- 
1.9.2

1	Patch for PHP 5.3.3 adapted from:
2
3	From 22736b7c56d678f142d5dd21f4996e5819507a2b Mon Sep 17 00:00:00 2001
4	From: Stanislav Malyshev <stas@php.net>
5	Date: Mon, 26 May 2014 17:42:18 -0700
6	Subject: [PATCH] Fix bug #67327: fileinfo: CDF infinite loop in nelements DoS
7
8	Upstream fix: https://github.com/file/file/commit/f97486ef5dc3e8735440edc4fc8808c63e1a3ef0
9	---
10	ext/fileinfo/libmagic/cdf.c \| 8 +++++++-
11	1 file changed, 7 insertions(+), 1 deletion(-)
12
13	diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
14	index 8dacd2f..4712e84 100644
15	--- a/ext/fileinfo/libmagic/cdf.c
16	+++ b/ext/fileinfo/libmagic/cdf.c
17	@@ -760,6 +760,10 @@ cdf_read_property_info(const cdf_stream_
18	inp[i].pi_type, (const char )q - (const char )p));
19	if (inp[i].pi_type & CDF_VECTOR) {
20	nelements = CDF_TOLE4(q[1]);
21	+ if (nelements == 0) {
22	+ DPRINTF(("CDF_VECTOR with nelements == 0\n"));
23	+ goto out;
24	+ }
25	o = 2;
26	} else {
27	nelements = 1;
28	@@ -815,7 +819,8 @@ cdf_read_property_info(const cdf_stream_
29	inp = *info + nelem;
30	}
31	DPRINTF(("nelements = %d\n", nelements));
32	- for (j = 0; j < nelements; j++, i++) {
33	+ for (j = 0; j < nelements && i < sh.sh_properties;
34	+ j++, i++) {
35	uint32_t l = CDF_TOLE4(q[o]);
36	inp[i].pi_str.s_len = l;
37	inp[i].pi_str.s_buf = (const char *)(&q[o+1]);
38	--
39	1.9.2
40