file/debian/patches/CVE-2014-8117.4.90018fe.patch

Subject: Bump recursion to 15, and allow it to be set from the command line
Upstream-Author: Christos Zoulas <christos@zoulas.com>
Date: Thu Nov 27 15:40:36 2014 +0000
Origin: FILE5_20-34-g90018fe
Last-Update: 2015-01-09

--- a/src/file.c
+++ b/src/file.c
@@ -106,7 +106,7 @@
 #undef OPT_LONGONLY
     {0, 0, NULL, 0}
 };
-#define OPTSTRING	"bcCde:f:F:hikLm:nNprsvz0"
+#define OPTSTRING	"bcCde:f:F:hikLm:nNprR:svz0"
 
 private const struct {
 	const char *name;
@@ -144,6 +144,7 @@
 	size_t i;
 	int action = 0, didsomefiles = 0, errflg = 0;
 	int flags = 0, e = 0;
+	size_t max_recursion = 0;
 	struct magic_set *magic = NULL;
 	int longindex;
 	const char *magicfile = NULL;		/* where the magic is	*/
@@ -244,6 +245,9 @@
 		case 'r':
 			flags |= MAGIC_RAW;
 			break;
+		case 'R':
+			max_recursion = atoi(optarg);
+			break;
 		case 's':
 			flags |= MAGIC_DEVICES;
 			break;
@@ -303,6 +307,15 @@
 		if (magic == NULL)
 			if ((magic = load(magicfile, flags)) == NULL)
 				return 1;
+		if (max_recursion) {
+			if (magic_setparam(magic, MAGIC_PARAM_MAX_RECURSION,
+			    &max_recursion) == -1) {
+				(void)fprintf(stderr,
+				    "%s: Can't set recurision %s\n", progname,
+				    strerror(errno));
+				return 1;
+			}
+		}
 		break;
 	}
 
--- a/src/file.h
+++ b/src/file.h
@@ -363,6 +363,8 @@
 	/* FIXME: Make the string dynamically allocated so that e.g.
 	   strings matched in files can be longer than MAXstring */
 	union VALUETYPE ms_value;	/* either number or string */
+	size_t max_recursion;
+#define	FILE_MAX_RECURSION	15
 };
 
 /* Type for Unicode characters */
--- a/src/file_opts.h
+++ b/src/file_opts.h
@@ -43,6 +43,7 @@
 OPT('p', "preserve-date", 0, "        preserve access times on files\n")
 #endif
 OPT('r', "raw", 0, "                  don't translate unprintable chars to \\ooo\n")
+OPT('R', "recursion", 0, "            set maximum recursion level\n")
 OPT('s', "special-files", 0, "        treat special (block/char devices) files as\n"
     "                             ordinary ones\n")
 OPT('C', "compile", 0, "              compile file specified by -m\n")
--- a/src/magic.c
+++ b/src/magic.c
@@ -142,6 +142,7 @@
 	ms->mlist = NULL;
 	ms->file = "unknown";
 	ms->line = 0;
+	ms->max_recursion = FILE_MAX_RECURSION;
 	return ms;
 free:
 	free(ms);
@@ -410,3 +411,29 @@
 	ms->flags = flags;
 	return 0;
 }
+
+public int
+magic_setparam(struct magic_set *ms, int param, const void *val)
+{
+	switch (param) {
+	case MAGIC_PARAM_MAX_RECURSION:
+		ms->max_recursion = *(const size_t *)val;
+		return 0;
+	default:
+		errno = EINVAL;
+		return -1;
+	}
+}
+
+public int
+magic_getparam(struct magic_set *ms, int param, void *val)
+{
+	switch (param) {
+	case MAGIC_PARAM_MAX_RECURSION:
+		*(size_t *)val = ms->max_recursion;
+		return 0;
+	default:
+		errno = EINVAL;
+		return -1;
+	}
+}
--- a/src/magic.h
+++ b/src/magic.h
@@ -82,6 +82,10 @@
 int magic_check(magic_t, const char *);
 int magic_errno(magic_t);
 
+#define MAGIC_PARAM_MAX_RECURSION	0
+int magic_setparam(magic_t, int, const void *);
+int magic_getparam(magic_t, int, void *);
+
 #ifdef __cplusplus
 };
 #endif
--- a/src/softmagic.c
+++ b/src/softmagic.c
@@ -43,9 +43,9 @@
 
 
 private int match(struct magic_set *, struct magic *, uint32_t,
-    const unsigned char *, size_t, int, int);
+    const unsigned char *, size_t, int, size_t);
 private int mget(struct magic_set *, const unsigned char *,
-    struct magic *, size_t, unsigned int, int);
+    struct magic *, size_t, unsigned int, size_t);
 private int magiccheck(struct magic_set *, struct magic *);
 private int32_t mprint(struct magic_set *, struct magic *);
 private int32_t moffset(struct magic_set *, struct magic *);
@@ -62,8 +62,6 @@
 
 #define OFFSET_OOB(n, o, i)	((n) < (o) || (i) > ((n) - (o)))
 
-#define MAX_RECURSION_LEVEL	10
-
 /*
  * softmagic - lookup one file in parsed, in-memory copy of database
  * Passed the name and FILE * of one file to be typed.
@@ -110,7 +108,7 @@
  */
 private int
 match(struct magic_set *ms, struct magic *magic, uint32_t nmagic,
-    const unsigned char *s, size_t nbytes, int mode, int recursion_level)
+    const unsigned char *s, size_t nbytes, int mode, size_t recursion_level)
 {
 	uint32_t magindex = 0;
 	unsigned int cont_level = 0;
@@ -1049,7 +1047,7 @@
 
 private int
 mget(struct magic_set *ms, const unsigned char *s,
-    struct magic *m, size_t nbytes, unsigned int cont_level, int recursion_level)
+    struct magic *m, size_t nbytes, unsigned int cont_level, size_t recursion_level)
 {
 	uint32_t offset = ms->offset;
 	file_pushbuf_t *pb;
@@ -1057,7 +1055,7 @@
 	char *rbuf;
 	union VALUETYPE *p = &ms->ms_value;
 
-	if (recursion_level >= MAX_RECURSION_LEVEL) {
+	if (recursion_level >= ms->max_recursion) {
                 file_error(ms, 0, "recursion nesting exceeded");
                 return -1;
         }