| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100 |
- Subject: PR/62: spinpx: limit size of file_printable
- ID: CVE-2019-8905 CVE-2019-8907
- Origin: FILE5_35-53-gd6578152 <https://github.com/file/file/commit/FILE5_35-53-gd6578152>
- Upstream-Author: Christos Zoulas <christos@zoulas.com>
- Date: Mon Feb 18 17:46:56 2019 +0000
- Bug-Debian: https://bugs.debian.org/922968
- --- a/src/file.h
- +++ b/src/file.h
- @@ -506,7 +506,7 @@
- size_t *);
- protected size_t file_pstring_length_size(const struct magic *);
- protected size_t file_pstring_get_length(const struct magic *, const char *);
- -protected char * file_printable(char *, size_t, const char *);
- +protected char * file_printable(char *, size_t, const char *, size_t);
- #ifdef __EMX__
- protected int file_os2_apptype(struct magic_set *, const char *, const void *,
- size_t);
- --- a/src/funcs.c
- +++ b/src/funcs.c
- @@ -623,12 +623,13 @@
- * convert string to ascii printable format.
- */
- protected char *
- -file_printable(char *buf, size_t bufsiz, const char *str)
- +file_printable(char *buf, size_t bufsiz, const char *str, size_t slen)
- {
- - char *ptr, *eptr;
- + char *ptr, *eptr = buf + bufsiz - 1;
- const unsigned char *s = (const unsigned char *)str;
- + const unsigned char *es = s + slen;
-
- - for (ptr = buf, eptr = ptr + bufsiz - 1; ptr < eptr && *s; s++) {
- + for (ptr = buf; ptr < eptr && s < es && *s; s++) {
- if (isprint(*s)) {
- *ptr++ = *s;
- continue;
- --- a/src/readelf.c
- +++ b/src/readelf.c
- @@ -757,7 +757,7 @@
- if (file_printf(ms, ", from '%.31s', pid=%u, uid=%u, "
- "gid=%u, nlwps=%u, lwp=%u (signal %u/code %u)",
- file_printable(sbuf, sizeof(sbuf),
- - RCAST(char *, pi.cpi_name)),
- + RCAST(char *, pi.cpi_name), sizeof(pi.cpi_name)),
- elf_getu32(swap, (uint32_t)pi.cpi_pid),
- elf_getu32(swap, pi.cpi_euid),
- elf_getu32(swap, pi.cpi_egid),
- @@ -1697,7 +1697,8 @@
- return -1;
- if (interp[0])
- if (file_printf(ms, ", interpreter %s",
- - file_printable(ibuf, sizeof(ibuf), interp)) == -1)
- + file_printable(ibuf, sizeof(ibuf), interp, sizeof(interp)))
- + == -1)
- return -1;
- return 0;
- }
- --- a/src/softmagic.c
- +++ b/src/softmagic.c
- @@ -634,8 +634,8 @@
- case FILE_LESTRING16:
- if (m->reln == '=' || m->reln == '!') {
- if (file_printf(ms, F(ms, desc, "%s"),
- - file_printable(sbuf, sizeof(sbuf), m->value.s))
- - == -1)
- + file_printable(sbuf, sizeof(sbuf), m->value.s,
- + sizeof(m->value.s))) == -1)
- return -1;
- t = ms->offset + m->vallen;
- }
- @@ -662,7 +662,8 @@
- }
-
- if (file_printf(ms, F(ms, desc, "%s"),
- - file_printable(sbuf, sizeof(sbuf), str)) == -1)
- + file_printable(sbuf, sizeof(sbuf), str,
- + sizeof(p->s) - (str - p->s))) == -1)
- return -1;
-
- if (m->type == FILE_PSTRING)
- @@ -768,7 +769,7 @@
- return -1;
- }
- rval = file_printf(ms, F(ms, desc, "%s"),
- - file_printable(sbuf, sizeof(sbuf), cp));
- + file_printable(sbuf, sizeof(sbuf), cp, ms->search.rm_len));
- free(cp);
-
- if (rval == -1)
- @@ -795,7 +796,8 @@
- break;
- case FILE_DER:
- if (file_printf(ms, F(ms, desc, "%s"),
- - file_printable(sbuf, sizeof(sbuf), ms->ms_value.s)) == -1)
- + file_printable(sbuf, sizeof(sbuf), ms->ms_value.s,
- + sizeof(ms->ms_value.s))) == -1)
- return -1;
- t = ms->offset;
- break;
|
