--- file-4.17/src/magic.c.cve-2007-1536 2005-10-17 11:13:13.000000000 -0600 +++ file-4.17/src/magic.c 2007-03-21 10:21:56.000000000 -0600 @@ -92,7 +92,7 @@ magic_open(int flags) goto free1; } - ms->o.ptr = ms->o.buf = malloc(ms->o.size = 1024); + ms->o.ptr = ms->o.buf = malloc(ms->o.left = ms->o.size = 1024); if (ms->o.buf == NULL) goto free1; @@ -104,7 +104,6 @@ magic_open(int flags) if (ms->c.off == NULL) goto free3; - ms->o.len = 0; ms->haderr = 0; ms->error = -1; ms->mlist = NULL; --- file-4.17/src/file.h.cve-2007-1536 2006-03-02 13:34:01.000000000 -0700 +++ file-4.17/src/file.h 2007-03-21 10:21:56.000000000 -0600 @@ -244,7 +244,7 @@ struct magic_set { /* Accumulation buffer */ char *buf; char *ptr; - size_t len; + size_t left; size_t size; /* Printable buffer */ char *pbuf; --- file-4.17/src/funcs.c.cve-2007-1536 2006-03-02 15:10:26.000000000 -0700 +++ file-4.17/src/funcs.c 2007-03-21 10:28:00.000000000 -0600 @@ -26,6 +26,7 @@ */ #include "file.h" #include "magic.h" +#include <assert.h> #include <stdarg.h> #include <stdlib.h> #include <string.h> @@ -49,28 +50,32 @@ protected int file_printf(struct magic_set *ms, const char *fmt, ...) { va_list ap; - size_t len; + size_t len, size; char *buf; va_start(ap, fmt); - if ((len = vsnprintf(ms->o.ptr, ms->o.len, fmt, ap)) >= ms->o.len) { + if ((len = vsnprintf(ms->o.ptr, ms->o.left, fmt, ap)) >= ms->o.left) { + long diff; /* XXX: really ptrdiff_t */ + va_end(ap); - if ((buf = realloc(ms->o.buf, len + 1024)) == NULL) { + size = (ms->o.size - ms->o.left) + len + 1024; + if ((buf = realloc(ms->o.buf, size)) == NULL) { file_oomem(ms); return -1; } - ms->o.ptr = buf + (ms->o.ptr - ms->o.buf); + diff = ms->o.ptr - ms->o.buf; + ms->o.ptr = buf + diff; ms->o.buf = buf; - ms->o.len = ms->o.size - (ms->o.ptr - ms->o.buf); - ms->o.size = len + 1024; + ms->o.left = size - diff; + ms->o.size = size; va_start(ap, fmt); - len = vsnprintf(ms->o.ptr, ms->o.len, fmt, ap); + len = vsnprintf(ms->o.ptr, ms->o.left, fmt, ap); } - ms->o.ptr += len; - ms->o.len -= len; va_end(ap); + ms->o.ptr += len; + ms->o.left -= len; return 0; } @@ -168,8 +173,8 @@ file_reset(struct magic_set *ms) protected const char * file_getbuffer(struct magic_set *ms) { - char *nbuf, *op, *np; - size_t nsize; + char *pbuf, *op, *np; + size_t psize, len; if (ms->haderr) return NULL; @@ -177,14 +182,17 @@ file_getbuffer(struct magic_set *ms) if (ms->flags & MAGIC_RAW) return ms->o.buf; - nsize = ms->o.len * 4 + 1; - if (ms->o.psize < nsize) { - if ((nbuf = realloc(ms->o.pbuf, nsize)) == NULL) { + len = ms->o.size - ms->o.left; + /* * 4 is for octal representation, + 1 is for NUL */ + psize = len * 4 + 1; + assert(psize > len); + if (ms->o.psize < psize) { + if ((pbuf = realloc(ms->o.pbuf, psize)) == NULL) { file_oomem(ms); return NULL; } - ms->o.psize = nsize; - ms->o.pbuf = nbuf; + ms->o.psize = psize; + ms->o.pbuf = pbuf; } #if defined(HAVE_WCHAR_H) && defined(HAVE_MBRTOWC) && defined(HAVE_WCWIDTH)