php/sme8/php-5.3.3-CVE-2014-3480.patch

From 40bade80cbe2af1d0b2cd0420cebd5d5905a2382 Mon Sep 17 00:00:00 2001
From: Christos Zoulas <christos@zoulas.com>
Date: Wed, 4 Jun 2014 17:23:19 +0000
Subject: [PATCH] Fix incorrect bounds check for sector count. (Francisco
 Alonso and Jan Kaluza at RedHat)

---
 src/cdf.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/cdf.c b/src/cdf.c
index 375406c..6652581 100644
--- a/ext/fileinfo/libmagic/cdf.c
+++ b/ext/fileinfo/libmagic/cdf.c
@@ -455,7 +455,8 @@ size_t
 cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 {
        size_t i, j;
-       cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+       cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+           / sizeof(maxsector));
 
        DPRINTF(("Chain:"));
        for (j = i = 0; sid >= 0; i++, j++) {
@@ -465,8 +466,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
                        errno = EFTYPE;
                        return (size_t)-1;
                }
-               if (sid > maxsector) {
-                       DPRINTF(("Sector %d > %d\n", sid, maxsector));
+               if (sid >= maxsector) {
+                       DPRINTF(("Sector %d >= %d\n", sid, maxsector));
                        errno = EFTYPE;
                        return (size_t)-1;
                }
-- 
1.9.3

1	vip-ire	1.1	From 40bade80cbe2af1d0b2cd0420cebd5d5905a2382 Mon Sep 17 00:00:00 2001
2			From: Christos Zoulas <christos@zoulas.com>
3			Date: Wed, 4 Jun 2014 17:23:19 +0000
4			Subject: [PATCH] Fix incorrect bounds check for sector count. (Francisco
5			Alonso and Jan Kaluza at RedHat)
6
7			---
8			src/cdf.c \| 9 +++++----
9			1 file changed, 5 insertions(+), 4 deletions(-)
10
11			diff --git a/src/cdf.c b/src/cdf.c
12			index 375406c..6652581 100644
13			--- a/ext/fileinfo/libmagic/cdf.c
14			+++ b/ext/fileinfo/libmagic/cdf.c
15			@@ -455,7 +455,8 @@ size_t
16			cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
17			{
18			size_t i, j;
19			- cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
20			+ cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
21			+ / sizeof(maxsector));
22
23			DPRINTF(("Chain:"));
24			for (j = i = 0; sid >= 0; i++, j++) {
25			@@ -465,8 +466,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
26			errno = EFTYPE;
27			return (size_t)-1;
28			}
29			- if (sid > maxsector) {
30			- DPRINTF(("Sector %d > %d\n", sid, maxsector));
31			+ if (sid >= maxsector) {
32			+ DPRINTF(("Sector %d >= %d\n", sid, maxsector));
33			errno = EFTYPE;
34			return (size_t)-1;
35			}
36			--
37			1.9.3
38