Skip to content

Commit c9e114a

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4: Fix bug #67705 (extensive backtracking in rule regular expression)
2 parents 95febf2 + eeaec70 commit c9e114a

File tree

4 files changed

+76
-21
lines changed

4 files changed

+76
-21
lines changed

‎NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ PHP NEWS
55
- COM:
66
. Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas).
77

8+
- Fileinfo:
9+
. Fixed bug #67705 (extensive backtracking in rule regular expression).
10+
(CVE-2014-3538) (Remi)
11+
812
- FPM:
913
. Fixed bug #67635 (php links to systemd libraries without using pkg-config).
1014
(pacho@gentoo.org, Remi)

‎ext/fileinfo/data_file.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115198,7 +115198,7 @@ const unsigned char php_magic_database[2606480] = {
115198115198
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
115199115199
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
115200115200
0x00, 0x00, 0x40, 0x00, 0x3D, 0x1B, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
115201-
0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
115201+
0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
115202115202
0x5E, 0x5C, 0x73, 0x7B, 0x30, 0x2C, 0x31, 0x30, 0x30, 0x7D, 0x42, 0x45, 0x47, 0x49, 0x4E, 0x5C,
115203115203
0x73, 0x7B, 0x30, 0x2C, 0x31, 0x30, 0x30, 0x7D, 0x5B, 0x7B, 0x5D, 0x00, 0x00, 0x00, 0x00, 0x00,
115204115204
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

‎ext/fileinfo/libmagic/softmagic.c

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ private int32_t mprint(struct magic_set *, struct magic *);
5858
private int32_t moffset(struct magic_set *, struct magic *);
5959
private void mdebug(uint32_t, const char *, size_t);
6060
private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
61-
const unsigned char *, uint32_t, size_t, size_t);
61+
const unsigned char *, uint32_t, size_t, struct magic *);
6262
private int mconvert(struct magic_set *, struct magic *, int);
6363
private int print_sep(struct magic_set *, int);
6464
private int handle_annotation(struct magic_set *, struct magic *);
@@ -1003,7 +1003,7 @@ mdebug(uint32_t offset, const char *str, size_t len)
10031003

10041004
private int
10051005
mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
1006-
const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
1006+
const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
10071007
{
10081008
/*
10091009
* Note: FILE_SEARCH and FILE_REGEX do not actually copy
@@ -1023,15 +1023,24 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
10231023
const char *last; /* end of search region */
10241024
const char *buf; /* start of search region */
10251025
const char *end;
1026-
size_t lines;
1026+
size_t lines, linecnt, bytecnt;
10271027

1028+
linecnt = m->str_range;
1029+
bytecnt = linecnt * 80;
1030+
1031+
if (bytecnt == 0) {
1032+
bytecnt = 8192;
1033+
}
1034+
if (bytecnt > nbytes) {
1035+
bytecnt = nbytes;
1036+
}
10281037
if (s == NULL) {
10291038
ms->search.s_len = 0;
10301039
ms->search.s = NULL;
10311040
return 0;
10321041
}
10331042
buf = RCAST(const char *, s) + offset;
1034-
end = last = RCAST(const char *, s) + nbytes;
1043+
end = last = RCAST(const char *, s) + bytecnt;
10351044
/* mget() guarantees buf <= last */
10361045
for (lines = linecnt, b = buf; lines && b < end &&
10371046
((b = CAST(const char *,
@@ -1044,7 +1053,7 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
10441053
b++;
10451054
}
10461055
if (lines)
1047-
last = RCAST(const char *, s) + nbytes;
1056+
last = RCAST(const char *, s) + bytecnt;
10481057

10491058
ms->search.s = buf;
10501059
ms->search.s_len = last - buf;
@@ -1118,7 +1127,6 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
11181127
int *need_separator, int *returnval)
11191128
{
11201129
uint32_t soffset, offset = ms->offset;
1121-
uint32_t count = m->str_range;
11221130
int rv, oneed_separator;
11231131
char *sbuf, *rbuf;
11241132
union VALUETYPE *p = &ms->ms_value;
@@ -1130,13 +1138,12 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
11301138
}
11311139

11321140
if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
1133-
(uint32_t)nbytes, count) == -1)
1141+
(uint32_t)nbytes, m) == -1)
11341142
return -1;
11351143

11361144
if ((ms->flags & MAGIC_DEBUG) != 0) {
11371145
fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
1138-
"nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
1139-
nbytes, count);
1146+
"nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
11401147
mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
11411148
}
11421149

@@ -1627,7 +1634,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
16271634
if ((ms->flags & MAGIC_DEBUG) != 0)
16281635
fprintf(stderr, "indirect +offs=%u\n", offset);
16291636
}
1630-
if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
1637+
if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
16311638
return -1;
16321639
ms->offset = offset;
16331640

@@ -2057,7 +2064,7 @@ magiccheck(struct magic_set *ms, struct magic *m)
20572064
zval *retval;
20582065
zval *subpats;
20592066
char *haystack;
2060-
2067+
20612068
MAKE_STD_ZVAL(retval);
20622069
ALLOC_INIT_ZVAL(subpats);
20632070

‎ext/fileinfo/magicdata.patch

Lines changed: 53 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Patches applied to file sources tree before generating magic.mgc
1+
Patches applied to file 5.14 sources tree before generating magic.mgc
22
and before running create_data_file.php to create data_file.c.
33

44

@@ -17,14 +17,6 @@ diff --git a/magic/Magdir/commands b/magic/Magdir/commands
1717
index 67c3eee..4a7d8dd 100644
1818
--- a/magic/Magdir/commands
1919
+++ b/magic/Magdir/commands
20-
@@ -1,6 +1,6 @@
21-
22-
#------------------------------------------------------------------------------
23-
-# $File: commands,v 1.44 2013/02/05 15:20:47 christos Exp $
24-
+# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
25-
# commands: file(1) magic for various shells and interpreters
26-
#
27-
#0 string/w : shell archive or script for antique kernel text
2820
@@ -49,7 +49,7 @@
2921
!:mime text/x-awk
3022
0 string/wt #!\ /usr/bin/awk awk script text executable
@@ -36,4 +28,56 @@ index 67c3eee..4a7d8dd 100644
3628
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
3729
--
3830
1.8.5.5
31+
From 0b478f445b6b7540b58af5d1fe583fa9e48fd745 Mon Sep 17 00:00:00 2001
32+
From: Christos Zoulas <christos@zoulas.com>
33+
Date: Wed, 28 May 2014 19:52:36 +0000
34+
Subject: [PATCH] further optimize awk by not looking for the BEGIN regex until
35+
we found the BEGIN (Jan Kaluza)
36+
37+
---
38+
magic/Magdir/commands | 5 +++--
39+
1 file changed, 3 insertions(+), 2 deletions(-)
40+
41+
diff --git a/magic/Magdir/commands b/magic/Magdir/commands
42+
index bfffdef..26b2869 100644
43+
--- a/magic/Magdir/commands
44+
+++ b/magic/Magdir/commands
45+
@@ -49,7 +49,8 @@
46+
!:mime text/x-awk
47+
0 string/wt #!\ /usr/bin/awk awk script text executable
48+
!:mime text/x-awk
49+
-0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
50+
+0 search/16384 BEGIN
51+
+>0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
52+
53+
# AT&T Bell Labs' Plan 9 shell
54+
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
55+
--
56+
2.0.3
57+
58+
From 71a8b6c0d758acb0f73e2e51421a711b5e9d6668 Mon Sep 17 00:00:00 2001
59+
From: Christos Zoulas <christos@zoulas.com>
60+
Date: Fri, 30 May 2014 16:48:44 +0000
61+
Subject: [PATCH] Limit regex search for BEGIN to the first 4K of the file.
62+
63+
---
64+
magic/Magdir/commands | 5 ++---
65+
1 file changed, 2 insertions(+), 3 deletions(-)
66+
67+
diff --git a/magic/Magdir/commands b/magic/Magdir/commands
68+
index 26b2869..bcd0f43 100644
69+
--- a/magic/Magdir/commands
70+
+++ b/magic/Magdir/commands
71+
@@ -49,8 +49,7 @@
72+
!:mime text/x-awk
73+
0 string/wt #!\ /usr/bin/awk awk script text executable
74+
!:mime text/x-awk
75+
-0 search/16384 BEGIN
76+
->0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
77+
+0 regex/4096 =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
78+
79+
# AT&T Bell Labs' Plan 9 shell
80+
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
81+
--
82+
2.0.3
3983

0 commit comments

Comments
 (0)