mirror of
https://github.com/php/php-src.git
synced 2025-08-19 08:49:28 +02:00
Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5: NEWS NEWS Bug #67412 fileinfo: cdf_count_chain insufficient boundary check
This commit is contained in:
commit
9ee147e6ff
1 changed files with 4 additions and 3 deletions
|
@ -470,7 +470,8 @@ size_t
|
||||||
cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
|
cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
|
||||||
{
|
{
|
||||||
size_t i, j;
|
size_t i, j;
|
||||||
cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
|
cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
|
||||||
|
/ sizeof(maxsector));
|
||||||
|
|
||||||
DPRINTF(("Chain:"));
|
DPRINTF(("Chain:"));
|
||||||
for (j = i = 0; sid >= 0; i++, j++) {
|
for (j = i = 0; sid >= 0; i++, j++) {
|
||||||
|
@ -480,8 +481,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
|
||||||
errno = EFTYPE;
|
errno = EFTYPE;
|
||||||
return (size_t)-1;
|
return (size_t)-1;
|
||||||
}
|
}
|
||||||
if (sid > maxsector) {
|
if (sid >= maxsector) {
|
||||||
DPRINTF(("Sector %d > %d\n", sid, maxsector));
|
DPRINTF(("Sector %d >= %d\n", sid, maxsector));
|
||||||
errno = EFTYPE;
|
errno = EFTYPE;
|
||||||
return (size_t)-1;
|
return (size_t)-1;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue