PR/550: Segv on DER parsing:

- use the correct variable for length
- set offset to 0 on failure.

diff --git a/src/der.c b/src/der.c
index af5f14943e5a92ca8db17ed747406dc3a88a7757..f36606b9d82eebcfa30b6ffc32d88d67bfc8f5dd 100644 (file)
--- a/src/der.c
+++ b/src/der.c
@@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: der.c,v 1.6 2016/04/21 14:26:03 christos Exp $")
+FILE_RCSID("@(#)$File: der.c,v 1.7 2016/06/01 22:01:15 christos Exp $")
 #endif
 #endif
 
@@ -221,7 +221,7 @@ int32_t
 der_offs(struct magic_set *ms, struct magic *m, size_t nbytes)
 {
        const uint8_t *b = CAST(const void *, ms->search.s);
-       size_t offs = 0, len = ms->search.rm_len ? ms->search.rm_len : nbytes;
+       size_t offs = 0, len = ms->search.s_len ? ms->search.s_len : nbytes;
 
        if (gettag(b, &offs, len) == DER_BAD)
                return -1;

diff --git a/src/softmagic.c b/src/softmagic.c
index 2ceb26c775af879c940c662a97d5c6b57428e080..153fffa2c7d0727cf73e718e1948745993b0865d 100644 (file)
--- a/src/softmagic.c
+++ b/src/softmagic.c
@@ -32,7 +32,7 @@
 #include "file.h"
 
 #ifndef        lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.231 2016/04/21 15:23:31 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.232 2016/06/01 22:01:15 christos Exp $")
 #endif /* lint */
 
 #include "magic.h"
@@ -827,6 +827,7 @@ moffset(struct magic_set *ms, struct magic *m, size_t nbytes, int32_t *op)
                                            "Bad DER offset %d nbytes=%zu",
                                            o, nbytes);
                                }
+                               *op = 0;
                                return 0;
                        }
                        break;