CVE-2014-3710

Community BUG:

Community CODE:

really:

This patch was created from the community reports above.

--- php-5.3.29/ext/fileinfo/libmagic/readelf.c_orig 2015-06-12 14:26:23.865377086 -0700

+++ php-5.3.29/ext/fileinfo/libmagic/readelf.c 2015-06-12 14:29:09.089820837 -0700

@@ -368,6 +368,13 @@

#endif

uint32_t namesz, descsz;

+ if (xnh_sizeof + offset > size) {

+ /*

+ * We're out of note headers.

+ */

+ return xnh_sizeof + offset;

+ }

+

(void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);

offset += xnh_sizeof;