compute the search match length correctly (found by oss-fuzzer)

diff --git a/src/softmagic.c b/src/softmagic.c
index 6a0375d3a581b961463c95f3e904b5378fc0d111..f2ba7dfa35c9c56f1d8fd5ed73c73c79f273905c 100644 (file)
--- a/src/softmagic.c
+++ b/src/softmagic.c
@@ -32,7 +32,7 @@
 #include "file.h"
 
 #ifndef        lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.240 2016/12/20 12:19:25 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.241 2016/12/20 13:29:20 christos Exp $")
 #endif /* lint */
 
 #include "magic.h"
@@ -1843,14 +1843,14 @@ magiccheck(struct magic_set *ms, struct magic *m)
                v = 0;
 
                for (idx = 0; m->str_range == 0 || idx < m->str_range; idx++) {
-                       if (slen + idx > ms->search.s_len)
+                       if (slen + idx >= ms->search.s_len)
                                break;
 
                        v = file_strncmp(m->value.s, ms->search.s + idx, slen,
                            m->str_flags);
                        if (v == 0) {   /* found match */
                                ms->search.offset += idx;
-                               ms->search.rm_len = m->str_range - idx;
+                               ms->search.rm_len = ms->search.s_len - idx;
                                break;
                        }
                }