diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
--- libmagic.orig/apprentice.c Tue Nov 19 22:01:12 2013
-+++ libmagic/apprentice.c Mon Mar 31 17:15:53 2014
++++ libmagic/apprentice.c Fri Oct 3 22:48:34 2014
@@ -29,6 +29,8 @@
* apprentice - make one pass through /etc/magic, learning its secrets.
*/
return NULL;
}
return map;
+@@ -1248,7 +1272,7 @@
+ * the sign extension must have happened.
+ */
+ case FILE_BYTE:
+- v = (char) v;
++ v = (signed char) v;
+ break;
+ case FILE_SHORT:
+ case FILE_BESHORT:
@@ -1516,7 +1540,7 @@
if (me->cont_count == me->max_count) {
struct magic *nm;
}
diff -u libmagic.orig/cdf.c libmagic/cdf.c
--- libmagic.orig/cdf.c Tue Feb 26 17:20:42 2013
-+++ libmagic/cdf.c Tue Jul 1 08:57:25 2014
++++ libmagic/cdf.c Fri Oct 3 22:48:34 2014
@@ -35,7 +35,7 @@
#include "file.h"
/* If the it is not there, just fake it; some docs don't have it */
if (d->d_stream_first_sector < 0)
-@@ -796,7 +815,11 @@
+@@ -796,11 +815,15 @@
if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
goto out;
for (i = 0; i < sh.sh_properties; i++) {
q = (const uint8_t *)(const void *)
((const char *)(const void *)p + ofs
- 2 * sizeof(uint32_t));
+- if (q > e) {
++ if (q < p || q > e) {
+ DPRINTF(("Ran of the end %p > %p\n", q, e));
+ goto out;
+ }
@@ -810,6 +833,10 @@
i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
if (inp[i].pi_type & CDF_VECTOR) {
}
diff -u libmagic.orig/funcs.c libmagic/funcs.c
--- libmagic.orig/funcs.c Thu Feb 13 00:20:53 2014
-+++ libmagic/funcs.c Wed Mar 19 13:28:34 2014
++++ libmagic/funcs.c Fri Oct 3 22:48:34 2014
+@@ -27,7 +27,7 @@
+ #include "file.h"
+
+ #ifndef lint
+-FILE_RCSID("@(#)$File: funcs.c,v 1.67 2014/02/12 23:20:53 christos Exp $")
++FILE_RCSID("@(#)$File: funcs.c,v 1.68 2014/02/18 11:09:31 kim Exp $")
+ #endif /* lint */
+
+ #include "magic.h"
@@ -41,79 +41,79 @@
#if defined(HAVE_WCTYPE_H)
#include <wctype.h>
{
int m = 0, rv = 0, looks_text = 0;
int mime = ms->flags & MAGIC_MIME;
-@@ -203,10 +202,10 @@
+@@ -174,8 +173,7 @@
+ const char *code_mime = "binary";
+ const char *type = "application/octet-stream";
+ const char *def = "data";
+-
+-
++ const char *ftype = NULL;
+
+ if (nb == 0) {
+ def = "empty";
+@@ -188,7 +186,7 @@
+
+ if ((ms->flags & MAGIC_NO_CHECK_ENCODING) == 0) {
+ looks_text = file_encoding(ms, ubuf, nb, &u8buf, &ulen,
+- &code, &code_mime, &type);
++ &code, &code_mime, &ftype);
+ }
+
+ #ifdef __EMX__
+@@ -203,10 +201,10 @@
}
}
#endif
if ((ms->flags & MAGIC_DEBUG) != 0)
(void)fprintf(stderr, "zmagic %d\n", m);
goto done_encoding;
-@@ -221,12 +220,17 @@
+@@ -221,12 +219,17 @@
}
/* Check if we have a CDF file */
/* try soft magic tests */
if ((ms->flags & MAGIC_NO_CHECK_SOFT) == 0)
-@@ -300,7 +304,6 @@
+@@ -268,7 +271,7 @@
+ if ((ms->flags & MAGIC_NO_CHECK_ENCODING) == 0) {
+ if (looks_text == 0)
+ if ((m = file_ascmagic_with_encoding( ms, ubuf,
+- nb, u8buf, ulen, code, type, looks_text))
++ nb, u8buf, ulen, code, ftype, looks_text))
+ != 0) {
+ if ((ms->flags & MAGIC_DEBUG) != 0)
+ (void)fprintf(stderr,
+@@ -300,7 +303,6 @@
return m;
}
protected int
file_reset(struct magic_set *ms)
-@@ -310,11 +313,11 @@
+@@ -310,11 +312,11 @@
return -1;
}
if (ms->o.buf) {
ms->o.pbuf = NULL;
}
ms->event_flags &= ~EVENT_HAD_ERR;
-@@ -333,7 +336,7 @@
+@@ -333,7 +335,7 @@
protected const char *
file_getbuffer(struct magic_set *ms)
{
size_t psize, len;
if (ms->event_flags & EVENT_HAD_ERR)
-@@ -348,15 +351,13 @@
+@@ -348,15 +350,13 @@
/* * 4 is for octal representation, + 1 is for NUL */
len = strlen(ms->o.buf);
if (len > (SIZE_MAX - 1) / 4) {
#if defined(HAVE_WCHAR_H) && defined(HAVE_MBRTOWC) && defined(HAVE_WCWIDTH)
{
-@@ -416,8 +417,8 @@
+@@ -416,8 +416,8 @@
if (level >= ms->c.len) {
len = (ms->c.len += 20) * sizeof(*ms->c.li);
ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ?
if (ms->c.li == NULL) {
file_oomem(ms, len);
return -1;
-@@ -437,32 +438,50 @@
+@@ -437,32 +437,50 @@
return ms->o.buf == NULL ? 0 : strlen(ms->o.buf);
}
}
diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
--- libmagic.orig/readcdf.c Tue Jan 7 04:13:42 2014
-+++ libmagic/readcdf.c Thu Jun 5 18:05:33 2014
++++ libmagic/readcdf.c Sat Oct 25 11:50:04 2014
@@ -26,11 +26,15 @@
#include "file.h"
#include <string.h>
#include <time.h>
#include <ctype.h>
-@@ -69,6 +73,44 @@
+@@ -69,6 +73,50 @@
{ NULL, NULL, },
};
+ { 0x00000000000c1084LLU, 0x46000000000000c0LLU },
+#endif
+ "x-msi",
++ },
++ { { 0, 0 },
++ NULL,
+ }
+}, clsid2desc[] = {
+ {
+#endif
+ "MSI Installer",
+ },
++ { { 0, 0 },
++ NULL,
++ }
+};
+
+private const char *
private const char *
cdf_app_to_mime(const char *vbuf, const struct nv *nv)
{
-@@ -87,16 +129,21 @@
+@@ -87,16 +135,21 @@
private int
cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
for (i = 0; i < count; i++) {
cdf_print_property_name(buf, sizeof(buf), info[i].pi_id);
switch (info[i].pi_type) {
-@@ -153,7 +200,7 @@
+@@ -153,7 +206,7 @@
buf, vbuf) == -1)
return -1;
}
CDF_PROPERTY_NAME_OF_APPLICATION) {
str = cdf_app_to_mime(vbuf, app2mime);
}
-@@ -162,8 +209,12 @@
+@@ -162,8 +215,12 @@
case CDF_FILETIME:
tp = info[i].pi_tp;
if (tp != 0) {
cdf_print_elapsed_time(tbuf,
sizeof(tbuf), tp);
if (NOTMIME(ms) && file_printf(ms,
-@@ -171,8 +222,11 @@
+@@ -171,8 +228,11 @@
return -1;
} else {
char *c, *ec;
if (c != NULL &&
(ec = strchr(c, '\n')) != NULL)
*ec = '\0';
-@@ -200,7 +254,7 @@
+@@ -200,7 +260,7 @@
private int
cdf_file_summary_info(struct magic_set *ms, const cdf_header_t *h,
{
cdf_summary_info_header_t si;
cdf_property_info_t *info;
-@@ -211,6 +265,8 @@
+@@ -211,6 +271,8 @@
return -1;
if (NOTMIME(ms)) {
if (file_printf(ms, "Composite Document File V2 Document")
== -1)
return -1;
-@@ -238,9 +294,15 @@
+@@ -238,9 +300,15 @@
return -2;
break;
}
free(info);
return m == -1 ? -2 : m;
-@@ -258,6 +320,7 @@
+@@ -258,6 +326,7 @@
int i;
const char *expn = "";
const char *corrupt = "corrupt: ";
info.i_fd = fd;
info.i_buf = buf;
-@@ -291,7 +354,8 @@
+@@ -291,7 +360,8 @@
goto out2;
}
expn = "Cannot read short stream";
goto out3;
}
-@@ -312,23 +376,21 @@
+@@ -312,23 +382,21 @@
#ifdef CDF_DEBUG
cdf_dump_summary_info(&h, &scn);
#endif
if (str != NULL) {
diff -u libmagic.orig/readelf.c libmagic/readelf.c
--- libmagic.orig/readelf.c Tue Nov 5 16:44:01 2013
-+++ libmagic/readelf.c Fri Feb 21 00:21:27 2014
++++ libmagic/readelf.c Sat Oct 25 11:50:04 2014
@@ -48,8 +48,8 @@
private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
off_t, int *, int);
file_badread(ms);
return -1;
}
-@@ -913,24 +928,12 @@
+@@ -477,6 +492,13 @@
+ uint32_t namesz, descsz;
+ unsigned char *nbuf = CAST(unsigned char *, vbuf);
+
++ if (xnh_sizeof + offset > size) {
++ /*
++ * We're out of note headers.
++ */
++ return xnh_sizeof + offset;
++ }
++
+ (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
+ offset += xnh_sizeof;
+
+@@ -913,24 +935,12 @@
return 0;
}
file_badread(ms);
return -1;
}
-@@ -955,14 +958,17 @@
+@@ -955,14 +965,17 @@
/* Things we can determine when we seek */
switch (xsh_type) {
case SHT_NOTE:
return -1;
}
-@@ -971,25 +977,16 @@
+@@ -971,25 +984,16 @@
if (noff >= (off_t)xsh_size)
break;
noff = donote(ms, nbuf, (size_t)noff,
file_badseek(ms);
return -1;
}
-@@ -1001,7 +998,7 @@
+@@ -1001,7 +1005,7 @@
MAX(sizeof cap32, sizeof cap64)];
if ((coff += xcap_sizeof) > (off_t)xsh_size)
break;
(ssize_t)xcap_sizeof) {
file_badread(ms);
return -1;
-@@ -1027,13 +1024,12 @@
+@@ -1027,13 +1031,12 @@
break;
}
}
if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
return -1;
if (cap_hw1) {
-@@ -1112,7 +1108,7 @@
+@@ -1112,7 +1115,7 @@
const char *shared_libraries = "";
unsigned char nbuf[BUFSIZ];
ssize_t bufsize;
if (size != xph_sizeof) {
if (file_printf(ms, ", corrupted program header size") == -1)
-@@ -1121,8 +1117,13 @@
+@@ -1121,8 +1124,13 @@
}
for ( ; num; num--) {
return -1;
}
-@@ -1160,9 +1161,12 @@
+@@ -1160,9 +1168,12 @@
* This is a PT_NOTE section; loop through all the notes
* in the section.
*/
if (bufsize == -1) {
file_badread(ms);
return -1;
-@@ -1223,7 +1227,7 @@
+@@ -1223,7 +1234,7 @@
/*
* If we cannot seek, it must be a pipe, socket or fifo.
*/
typedef uint8_t Elf64_Char;
diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
--- libmagic.orig/softmagic.c Thu Feb 13 00:20:53 2014
-+++ libmagic/softmagic.c Tue Jul 1 08:57:25 2014
++++ libmagic/softmagic.c Mon Aug 4 14:58:55 2014
@@ -50,6 +50,11 @@
#include <locale.h>
#endif
private int match(struct magic_set *, struct magic *, uint32_t,
const unsigned char *, size_t, size_t, int, int, int, int, int *, int *,
+@@ -62,7 +67,7 @@
+ private int32_t moffset(struct magic_set *, struct magic *);
+ private void mdebug(uint32_t, const char *, size_t);
+ private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
+- const unsigned char *, uint32_t, size_t, size_t);
++ const unsigned char *, uint32_t, size_t, struct magic *);
+ private int mconvert(struct magic_set *, struct magic *, int);
+ private int print_sep(struct magic_set *, int);
+ private int handle_annotation(struct magic_set *, struct magic *);
@@ -71,7 +76,8 @@
private void cvt_32(union VALUETYPE *, const struct magic *);
private void cvt_64(union VALUETYPE *, const struct magic *);
while (len--)
*ptr1++ = *ptr2++;
*ptr1 = '\0';
-@@ -1178,9 +1170,6 @@
- "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
- nbytes, count);
+@@ -1046,7 +1038,7 @@
+
+ private int
+ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
+- const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
++ const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
+ {
+ /*
+ * Note: FILE_SEARCH and FILE_REGEX do not actually copy
+@@ -1066,15 +1058,24 @@
+ const char *last; /* end of search region */
+ const char *buf; /* start of search region */
+ const char *end;
+- size_t lines;
++ size_t lines, linecnt, bytecnt;
+
++ linecnt = m->str_range;
++ bytecnt = linecnt * 80;
++
++ if (bytecnt == 0) {
++ bytecnt = 8192;
++ }
++ if (bytecnt > nbytes) {
++ bytecnt = nbytes;
++ }
+ if (s == NULL) {
+ ms->search.s_len = 0;
+ ms->search.s = NULL;
+ return 0;
+ }
+ buf = RCAST(const char *, s) + offset;
+- end = last = RCAST(const char *, s) + nbytes;
++ end = last = RCAST(const char *, s) + bytecnt;
+ /* mget() guarantees buf <= last */
+ for (lines = linecnt, b = buf; lines && b < end &&
+ ((b = CAST(const char *,
+@@ -1087,7 +1088,7 @@
+ b++;
+ }
+ if (lines)
+- last = RCAST(const char *, s) + nbytes;
++ last = RCAST(const char *, s) + bytecnt;
+
+ ms->search.s = buf;
+ ms->search.s_len = last - buf;
+@@ -1158,7 +1159,6 @@
+ int *need_separator, int *returnval)
+ {
+ uint32_t soffset, offset = ms->offset;
+- uint32_t count = m->str_range;
+ int rv, oneed_separator, in_type;
+ char *sbuf, *rbuf;
+ union VALUETYPE *p = &ms->ms_value;
+@@ -1170,17 +1170,13 @@
+ }
+
+ if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
+- (uint32_t)nbytes, count) == -1)
++ (uint32_t)nbytes, m) == -1)
+ return -1;
+
+ if ((ms->flags & MAGIC_DEBUG) != 0) {
+ fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
+- "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
+- nbytes, count);
++ "nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
-#ifndef COMPILE_ONLY
- file_mdump(m);
}
if (m->flag & INDIR) {
-@@ -1679,9 +1668,6 @@
+@@ -1672,16 +1668,13 @@
+ if ((ms->flags & MAGIC_DEBUG) != 0)
+ fprintf(stderr, "indirect +offs=%u\n", offset);
+ }
+- if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
++ if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
+ return -1;
+ ms->offset = offset;
+
if ((ms->flags & MAGIC_DEBUG) != 0) {
mdebug(offset, (char *)(void *)p,
sizeof(union VALUETYPE));
}
}
-@@ -1755,11 +1741,21 @@
+@@ -1755,11 +1748,21 @@
ms->offset = soffset;
if (rv == 1) {
if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
}
return rv;
-@@ -1875,6 +1871,42 @@
+@@ -1875,6 +1878,42 @@
return file_strncmp(a, b, len, flags);
}
private int
magiccheck(struct magic_set *ms, struct magic *m)
{
-@@ -2035,63 +2067,151 @@
+@@ -2035,63 +2074,151 @@
break;
}
case FILE_REGEX: {
+ zval *retval;
+ zval *subpats;
+ char *haystack;
-+
++
+ MAKE_STD_ZVAL(retval);
+ ALLOC_INIT_ZVAL(subpats);
+