Browse Source

Fixed Bug #66987 Memory corruption in fileinfo ext (bigendian)

On little endian:
	map->p == php_magic_database
	map->magic[i] = pointer into the map

	map->p == NULL
	map->magic[i] = pointer to allocated memory

On big endian (ppc64, s390x, ...):
	map->p != php_magic_database and map->p != NULL
        map->magic[i] = pointer into a copy of the map

Trying to efree pointer in the later cause memory corruption
Thanks to dkatulek / Red Hat for the report.
pull/518/merge
Remi Collet 12 years ago
parent
commit
2c204a55af
  1. 14
      ext/fileinfo/libmagic/apprentice.c

14
ext/fileinfo/libmagic/apprentice.c

@ -493,12 +493,14 @@ apprentice_unmap(struct magic_map *map)
if (map == NULL)
return;
if (map->p != php_magic_database) {
int j;
for (j = 0; j < MAGIC_SETS; j++) {
if (map->magic[j])
efree(map->magic[j]);
}
if (map->p != NULL) {
if (map->p == NULL) {
int j;
for (j = 0; j < MAGIC_SETS; j++) {
if (map->magic[j]) {
efree(map->magic[j]);
}
}
} else {
efree(map->p);
}
}

Loading…
Cancel
Save