PR/550: Segv on DER parsing:

- use the correct variable for length
- set offset to 0 on failure.

diff --git a/src/der.c b/src/der.c
index ff17c9c0c3e3f0532cb8fccceb1f21c12057243b..fcdeb6c798145a98febc3a202e334d901daea256 100644 (file)
--- a/src/der.c
+++ b/src/der.c
@@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: der.c,v 1.5 2016/04/17 19:44:45 christos Exp $")
+FILE_RCSID("@(#)$File: der.c,v 1.6 2016/04/21 14:26:03 christos Exp $")
 #endif
 #endif
 
@@ -221,7 +221,7 @@ int32_t
 der_offs(struct magic_set *ms, struct magic *m, size_t nbytes)
 {
        const uint8_t *b = CAST(const void *, ms->search.s);
-       size_t offs = 0, len = ms->search.rm_len ? ms->search.rm_len : nbytes;
+       size_t offs = 0, len = ms->search.s_len ? ms->search.s_len : nbytes;
 
        if (gettag(b, &offs, len) == DER_BAD)
                return -1;

diff --git a/src/softmagic.c b/src/softmagic.c
index 84e394c3cc60488442c1ffecad36c3b21b9c58e3..6479b3494bccde5cfd6029a1dbf80601df1a3dcc 100644 (file)
--- a/src/softmagic.c
+++ b/src/softmagic.c
@@ -32,7 +32,7 @@
 #include "file.h"
 
 #ifndef        lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.230 2016/04/18 15:10:34 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.231 2016/04/21 15:23:31 christos Exp $")
 #endif /* lint */
 
 #include "magic.h"
@@ -827,6 +827,7 @@ moffset(struct magic_set *ms, struct magic *m, size_t nbytes, int32_t *op)
                                            "Bad DER offset %d nbytes=%zu",
                                            o, nbytes);
                                }
+                               *op = 0;
                                return 0;
                        }
                        break;