From 2c204a55af9b903b3db48dd5a75d492dbf1b387d Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@php.net>
Date: Mon, 31 Mar 2014 16:50:47 +0200
Subject: [PATCH 1/3] Fixed Bug #66987 Memory corruption in fileinfo ext
 (bigendian)

On little endian:
	map->p == php_magic_database
	map->magic[i] = pointer into the map

	map->p == NULL
	map->magic[i] = pointer to allocated memory

On big endian (ppc64, s390x, ...):
	map->p != php_magic_database and map->p != NULL
        map->magic[i] = pointer into a copy of the map

Trying to efree pointer in the later cause memory corruption
Thanks to dkatulek / Red Hat for the report.
---
 ext/fileinfo/libmagic/apprentice.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/ext/fileinfo/libmagic/apprentice.c b/ext/fileinfo/libmagic/apprentice.c
index 11920e65891..fd82564bff7 100644
--- a/ext/fileinfo/libmagic/apprentice.c
+++ b/ext/fileinfo/libmagic/apprentice.c
@@ -493,12 +493,14 @@ apprentice_unmap(struct magic_map *map)
 	if (map == NULL)
 		return;
 	if (map->p != php_magic_database) {
-		int j;
-		for (j = 0; j < MAGIC_SETS; j++) {
-			if (map->magic[j])
-				efree(map->magic[j]);
-		}
-		if (map->p != NULL) {
+		if (map->p == NULL) {
+			int j;
+			for (j = 0; j < MAGIC_SETS; j++) {
+				if (map->magic[j]) {
+					efree(map->magic[j]);
+				}
+			}
+		} else {
 			efree(map->p);
 		}
 	}

From fca331cae9c229dd52d762222532ba621039030e Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@php.net>
Date: Mon, 31 Mar 2014 16:57:02 +0200
Subject: [PATCH 2/3] NEWS

---
 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NEWS b/NEWS
index 013392c63bd..82db047e23f 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,10 @@ PHP                                                                        NEWS
 - Embed:
   . Fixed bug #65715 (php5embed.lib isn't provided anymore). (Anatol)
 
+- Fileinfo:
+  . Fixed bug #66987i (Memory corruption in fileinfo ext / bigendian).
+    (Remi)
+
 ?? ??? 2014, PHP 5.4.27
 
 - Core:

From 60fb57d4f672d08b8aaa39469c4eba92af08265b Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@php.net>
Date: Mon, 31 Mar 2014 16:57:29 +0200
Subject: [PATCH 3/3] NEWS

---
 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NEWS b/NEWS
index c84c1de45d8..57ff613eb6e 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,10 @@ PHP                                                                        NEWS
 - Embed:
   . Fixed bug #65715 (php5embed.lib isn't provided anymore). (Anatol).
 
+- Fileinfo:
+  . Fixed bug #66987i (Memory corruption in fileinfo ext / bigendian).
+    (Remi)
+
 - mysqli:
   . Fixed problem in mysqli_commit()/mysqli_rollback() with second parameter
     (extra comma) and third parameters (lack of escaping). (Andrey)