| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100 |
- Subject: PR/62: spinpx: limit size of file_printable
- ID: CVE-2019-8905 CVE-2019-8907
- Origin: FILE5_35-53-gd6578152 <https://github.com/file/file/commit/FILE5_35-53-gd6578152>
- Upstream-Author: Christos Zoulas <christos@zoulas.com>
- Date: Mon Feb 18 17:46:56 2019 +0000
- Bug-Debian: https://bugs.debian.org/901351
- --- a/src/file.h
- +++ b/src/file.h
- @@ -491,7 +491,7 @@
- size_t *);
- protected size_t file_pstring_length_size(const struct magic *);
- protected size_t file_pstring_get_length(const struct magic *, const char *);
- -protected char * file_printable(char *, size_t, const char *);
- +protected char * file_printable(char *, size_t, const char *, size_t);
- #ifdef __EMX__
- protected int file_os2_apptype(struct magic_set *, const char *, const void *,
- size_t);
- --- a/src/funcs.c
- +++ b/src/funcs.c
- @@ -581,12 +581,13 @@
- * convert string to ascii printable format.
- */
- protected char *
- -file_printable(char *buf, size_t bufsiz, const char *str)
- +file_printable(char *buf, size_t bufsiz, const char *str, size_t slen)
- {
- - char *ptr, *eptr;
- + char *ptr, *eptr = buf + bufsiz - 1;
- const unsigned char *s = (const unsigned char *)str;
- + const unsigned char *es = s + slen;
-
- - for (ptr = buf, eptr = ptr + bufsiz - 1; ptr < eptr && *s; s++) {
- + for (ptr = buf; ptr < eptr && s < es && *s; s++) {
- if (isprint(*s)) {
- *ptr++ = *s;
- continue;
- --- a/src/readelf.c
- +++ b/src/readelf.c
- @@ -725,7 +725,7 @@
- */
- if (file_printf(ms, ", from '%.31s'",
- file_printable(sbuf, sizeof(sbuf),
- - (const char *)&nbuf[doff + 0x7c])) == -1)
- + (const char *)&nbuf[doff + 0x7c], 32)) == -1)
- return 1;
-
- /*
- @@ -1543,7 +1543,8 @@
- return -1;
- if (interp[0])
- if (file_printf(ms, ", interpreter %s",
- - file_printable(ibuf, sizeof(ibuf), interp)) == -1)
- + file_printable(ibuf, sizeof(ibuf), interp, strlen(interp)))
- + == -1)
- return -1;
- return 0;
- }
- --- a/src/softmagic.c
- +++ b/src/softmagic.c
- @@ -544,8 +544,8 @@
- case FILE_LESTRING16:
- if (m->reln == '=' || m->reln == '!') {
- if (file_printf(ms, F(ms, m, "%s"),
- - file_printable(sbuf, sizeof(sbuf), m->value.s))
- - == -1)
- + file_printable(sbuf, sizeof(sbuf), m->value.s,
- + sizeof(m->value.s))) == -1)
- return -1;
- t = ms->offset + m->vallen;
- }
- @@ -572,7 +572,8 @@
- }
-
- if (file_printf(ms, F(ms, m, "%s"),
- - file_printable(sbuf, sizeof(sbuf), str)) == -1)
- + file_printable(sbuf, sizeof(sbuf), str,
- + sizeof(p->s) - (str - p->s))) == -1)
- return -1;
-
- if (m->type == FILE_PSTRING)
- @@ -678,7 +679,7 @@
- return -1;
- }
- rval = file_printf(ms, F(ms, m, "%s"),
- - file_printable(sbuf, sizeof(sbuf), cp));
- + file_printable(sbuf, sizeof(sbuf), cp, ms->search.rm_len));
- free(cp);
-
- if (rval == -1)
- @@ -705,7 +706,8 @@
- break;
- case FILE_DER:
- if (file_printf(ms, F(ms, m, "%s"),
- - file_printable(sbuf, sizeof(sbuf), ms->ms_value.s)) == -1)
- + file_printable(sbuf, sizeof(sbuf), ms->ms_value.s,
- + sizeof(ms->ms_value.s))) == -1)
- return -1;
- t = ms->offset;
- break;
|
