Fix bug #68283: fileinfo: out-of-bounds read in elf note headers

Upstream commit
https://github.com/file/file/commit/39c7ac1106be844a5296d3eb5971946cc09ffda0

CVE -2014-3710

diff --git a/ext/fileinfo/libmagic/readelf.c b/ext/fileinfo/libmagic/readelf.c
index 1c3845fc6b106dc4ac91f3f5c97d6c4499faf69b..bb6f70fb8b7c739092f1ee5f1c4d8e72239ff44b 100644 (file)
--- a/ext/fileinfo/libmagic/readelf.c
+++ b/ext/fileinfo/libmagic/readelf.c
@@ -372,6 +372,13 @@ donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size,
        uint32_t namesz, descsz;
        unsigned char *nbuf = CAST(unsigned char *, vbuf);
 
+       if (xnh_sizeof + offset > size) {
+               /*
+                * We're out of note headers.
+                */
+               return xnh_sizeof + offset;
+       }
+
        (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
        offset += xnh_sizeof;