Bug #67412 fileinfo: cdf_count_chain insufficient boundary check

Upstream:
https://github.com/file/file/commit/40bade80cbe2af1d0b2cd0420cebd5d5905a2382

diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
index 5dce5ced5801070b2f732ad90d301458905cefda..3b6f4881d971d181b823cdceedc943c3abd41e80 100644 (file)
--- a/ext/fileinfo/libmagic/cdf.c
+++ b/ext/fileinfo/libmagic/cdf.c
@@ -470,7 +470,8 @@ size_t
 cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 {
        size_t i, j;
-       cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+       cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+           / sizeof(maxsector));
 
        DPRINTF(("Chain:"));
        for (j = i = 0; sid >= 0; i++, j++) {
@@ -480,8 +481,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
                        errno = EFTYPE;
                        return (size_t)-1;
                }
-               if (sid > maxsector) {
-                       DPRINTF(("Sector %d > %d\n", sid, maxsector));
+               if (sid >= maxsector) {
+                       DPRINTF(("Sector %d >= %d\n", sid, maxsector));
                        errno = EFTYPE;
                        return (size_t)-1;
                }