hitoshura25/cvefixes huggingface dataset:
CVE-2014-2270 (C, published 2014-03-14T15:55Z)
Description: value: softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/file/file
Files changed:
src/softmagic.c
Commit message: PR/313: Aaron Reffett: Check properly for exceeding the offset.


Vulnerable code:
FILE_RCSID("@(#)$File: softmagic.c,v 1.170 2014/01/06 02:25:32 christos Exp $")
			if (nbytes < offset || nbytes < (offset + 1))
			if (nbytes < offset || nbytes < (offset + 2))
			if (nbytes < offset || nbytes < (offset + 2))
			if (nbytes < offset || nbytes < (offset + 2))
			if (nbytes < offset || nbytes < (offset + 4))
			if (nbytes < offset || nbytes < (offset + 4))
			if (nbytes < offset || nbytes < (offset + 4))
			if (nbytes < offset || nbytes < (offset + 4))
		if (nbytes < (offset + 1)) /* should alway be true */
		if (nbytes < (offset + 2))
		if (nbytes < (offset + 4))
		if (nbytes < (offset + 8))
		if (nbytes < (offset + m->vallen))
		if (nbytes < offset)
		if (nbytes < offset)
		if (nbytes < offset)

Fixed code:
FILE_RCSID("@(#)$File: softmagic.c,v 1.171 2014/01/08 22:02:06 christos Exp $")
#define OFFSET_OOB(n, o, i)	((n) < (o) || (i) >= ((n) - (o)))
			if (OFFSET_OOB(nbytes, offset, 1))
			if (OFFSET_OOB(nbytes, offset, 2))
			if (OFFSET_OOB(nbytes, offset, 2))
			if (OFFSET_OOB(nbytes, offset, 2))
			if (OFFSET_OOB(nbytes, offset, 4))
			if (OFFSET_OOB(nbytes, offset, 4))
			if (OFFSET_OOB(nbytes, offset, 4))
			if (OFFSET_OOB(nbytes, offset, 4))
		if (OFFSET_OOB(nbytes, offset, 1))
		if (OFFSET_OOB(nbytes, offset, 2))
		if (OFFSET_OOB(nbytes, offset, 4))
		if (OFFSET_OOB(nbytes, offset, 8))
		if (OFFSET_OOB(nbytes, offset, m->vallen))
		if (OFFSET_OOB(nbytes, offset, 0))
		if (OFFSET_OOB(nbytes, offset, 0))
		if (OFFSET_OOB(nbytes, offset, 0))
CVE-2014-3478 (C, published 2014-07-09T11:07Z)
Description: value: Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/file/file
Files changed:
src/softmagic.c
Commit message: Correctly compute the truncated pascal string size (Francisco Alonso and
Jan Kaluza at RedHat)


Vulnerable code:
FILE_RCSID("@(#)$File: softmagic.c,v 1.189 2014/05/30 16:47:44 christos Exp $")
		char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m);
		if (len >= sizeof(p->s))
			len = sizeof(p->s) - 1;

Fixed code:
FILE_RCSID("@(#)$File: softmagic.c,v 1.190 2014/06/03 19:01:34 christos Exp $")
		size_t sz = file_pstring_length_size(m);
		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
		if (len >= sizeof(p->s)) {
			/*
			 * The size of the pascal string length (sz)
			 * is 1, 2, or 4. We need at least 1 byte for NUL
			 * termination, but we've already truncated the
			 * string by p->s, so we need to deduct sz.
			 */ 
			len = sizeof(p->s) - sz;
		}
CVE-2014-3479 (C, published 2014-07-09T11:07Z)
Description: value: The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/file/file
Files changed:
src/cdf.c
Commit message: Use the proper sector size when checking stream offsets (Francisco Alonso and
Jan Kaluza at RedHat)


Vulnerable code:
FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $")
	if (e >= b && (size_t)(e - b) <= CDF_SEC_SIZE(h) * sst->sst_len)
	    CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len));

Fixed code:
FILE_RCSID("@(#)$File: cdf.c,v 1.61 2014/06/04 17:23:19 christos Exp $")
	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
	if (e >= b && (size_t)(e - b) <= ss * sst->sst_len)
	    ss * sst->sst_len, ss, sst->sst_len));
CVE-2014-3480 (C, published 2014-07-09T11:07Z)
Description: value: The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/file/file
Files changed:
src/cdf.c
Commit message: Fix incorrect bounds check for sector count. (Francisco Alonso and Jan Kaluza
at RedHat)


Vulnerable code:
FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $")
	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
		if (sid > maxsector) {
			DPRINTF(("Sector %d > %d\n", sid, maxsector));

Fixed code:
FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $")
	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
	    / sizeof(maxsector));
		if (sid >= maxsector) {
			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
CVE-2014-3487 (C, published 2014-07-09T11:07Z)
Description: value: The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/file/file
Files changed:
src/cdf.c
Commit message: Add missing check offset test (Francisco Alonso, Jan Kaluza at RedHat)


Vulnerable code:
FILE_RCSID("@(#)$File: cdf.c,v 1.61 2014/06/04 17:23:19 christos Exp $")
		size_t ofs = CDF_GETUINT32(p, (i << 1) + 1);

Fixed code:
FILE_RCSID("@(#)$File: cdf.c,v 1.62 2014/06/04 17:26:07 christos Exp $")
		size_t tail = (i << 1) + 1;
		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
		    __LINE__) == -1)
			goto out;
		size_t ofs = CDF_GETUINT32(p, tail);
CVE-2014-3538 (Other, published 2014-07-03T14:55Z)
Description: value: file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/file/file
Files changed:
doc/magic.man
Commit message: Update regex recommendation.


Vulnerable code:
.\" $File: magic.man,v 1.80 2014/03/07 23:11:16 christos Exp $
.Dd April 22, 2013
The type specification can be optionally followed by

Fixed code:
.\" $File: magic.man,v 1.81 2014/03/08 17:28:08 christos Exp $
.Dd May 30, 2014
The size of the string to search should also be limited by specifying
.Dv /<length> ,
to avoid performance issues scanning long files.
The type specification can also be optionally followed by
CVE-2014-3538 (Other, published 2014-07-03T14:55Z)
Description: value: file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/file/file
Files changed:
ChangeLog
Commit message: document regex limit.


Vulnerable code:

Fixed code:
2014-05-30  12:51  Christos Zoulas <christos@zoulas.com>

	* Make the range operator limit the length of the
	  regex search.
CVE-2014-3538 (C, published 2014-07-03T14:55Z)
Description: value: file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/file/file
Files changed:
src/softmagic.c
Commit message: If requested, limit search length.


Vulnerable code:
FILE_RCSID("@(#)$File: softmagic.c,v 1.187 2014/05/13 16:42:17 christos Exp $")
			size_t l = ms->search.s_len - 1;
			char c = ms->search.s[l];
			((char *)(intptr_t)ms->search.s)[l] = '\0';
			pmatch[0].rm_eo = ms->search.s_len;

Fixed code:
FILE_RCSID("@(#)$File: softmagic.c,v 1.188 2014/05/14 23:15:42 christos Exp $")
#ifndef REG_STARTEND
			char c;
#endif
			size_t slen = ms->search.s_len;
			/* Limit by offset if requested */
			if (m->str_range > 0)
				slen = MIN(slen, m->str_range);
			if (slen != 0)
				slen--;
			c = ms->search.s[slen];
			((char *)(intptr_t)ms->search.s)[slen] = '\0';
			pmatch[0].rm_eo = slen;
CVE-2014-3538 (Other, published 2014-07-03T14:55Z)
Description: value: file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/file/file
Files changed:
magic/Magdir/commands
Commit message: Limit regex search for BEGIN to the first 4K of the file.


Vulnerable code:
# $File: commands,v 1.48 2014/03/04 12:20:42 kim Exp $
0       search/16384    BEGIN
>0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text

Fixed code:
# $File: commands,v 1.49 2014/05/28 19:52:36 christos Exp $
0	regex/4096	=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
CVE-2014-3587 (C, published 2014-08-23T01:55Z)
Description: value: Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/file/file
Files changed:
src/cdf.c
Commit message: Prevent wrap around (Remi Collet at redhat)


Vulnerable code:
FILE_RCSID("@(#)$File: cdf.c,v 1.63 2014/06/09 13:04:37 christos Exp $")

Fixed code:
FILE_RCSID("@(#)$File: cdf.c,v 1.64 2014/07/24 19:35:39 christos Exp $")
		if (q < p) {
			DPRINTF(("Wrapped around %p < %p\n", q, p));
			goto out;
		}
CVE-2014-3710 (Other, published 2014-11-05T11:55Z)
Description: value: The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/file/file
Files changed:
ChangeLog
src/readelf.c
Commit message: Fix note bounds reading, Francisco Alonso / Red Hat


Vulnerable code:
FILE_RCSID("@(#)$File: readelf.c,v 1.102 2014/03/11 21:00:13 christos Exp $")

Fixed code:
2014-10-17  11:48  Christos Zoulas <christos@zoulas.com>

	* fix bounds in note reading (Francisco Alonso / Red Hat)

FILE_RCSID("@(#)$File: readelf.c,v 1.103 2014/05/02 02:25:10 christos Exp $")
	if (xnh_sizeof + offset > size) {
		/*
		 * We're out of note headers.
		 */
		return xnh_sizeof + offset;
	}
CVE-2014-8116 (C, published 2014-12-17T19:59Z)
Description: value: The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/file/file
Files changed:
src/readelf.c
Commit message: Stop reporting bad capabilities after the first few.


Vulnerable code:
FILE_RCSID("@(#)$File: readelf.c,v 1.104 2014/10/17 15:49:00 christos Exp $")

Fixed code:
FILE_RCSID("@(#)$File: readelf.c,v 1.105 2014/11/22 16:04:29 christos Exp $")
	size_t nbadcap = 0;
			if (nbadcap > 5)
				break;
					if (nbadcap++ > 2)
						coff = xsh_size;
CVE-2014-8116 (C, published 2014-12-17T19:59Z)
Description: value: The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/file/file
Files changed:
src/elfclass.h
src/readelf.c
Commit message: - limit the number of program and section header number of sections to be
  processed to avoid excessive processing time.
- if a bad note is found, return 0 to stop processing immediately.


Vulnerable code:
		    (off_t)elf_getu(swap, elfhdr.e_phoff),
		    elf_getu16(swap, elfhdr.e_phnum), 
		    (off_t)elf_getu(swap, elfhdr.e_phoff),
		    elf_getu16(swap, elfhdr.e_phnum), 
		    fsize, &flags, elf_getu16(swap, elfhdr.e_shnum))
		    == -1)
		    (off_t)elf_getu(swap, elfhdr.e_shoff),
		    elf_getu16(swap, elfhdr.e_shnum),
FILE_RCSID("@(#)$File: readelf.c,v 1.103 2014/05/02 02:25:10 christos Exp $")
	    return offset;
	    return offset;
	uint16_t type;

Fixed code:
		phnum = elf_getu16(swap, elfhdr.e_phnum);
		if (phnum > MAX_PHNUM)
			return toomany(ms, "program", phnum);
		    (off_t)elf_getu(swap, elfhdr.e_phoff), phnum,
		phnum = elf_getu16(swap, elfhdr.e_phnum);
		if (phnum > MAX_PHNUM)
			return toomany(ms, "program", phnum);
		shnum = elf_getu16(swap, elfhdr.e_shnum);
		if (shnum > MAX_SHNUM)
			return toomany(ms, "section", shnum);
		    (off_t)elf_getu(swap, elfhdr.e_phoff), phnum,
		    fsize, &flags, shnum) == -1)
		shnum = elf_getu16(swap, elfhdr.e_shnum);
		if (shnum > MAX_SHNUM)
			return toomany(ms, "section", shnum);
		    (off_t)elf_getu(swap, elfhdr.e_shoff), shnum,
FILE_RCSID("@(#)$File: readelf.c,v 1.104 2014/10/17 15:49:00 christos Exp $")
#define MAX_PHNUM	256
#define	MAX_SHNUM	1024

private int
toomany(struct magic_set *ms, const char *name, uint16_t num)
{
	if (file_printf(ms, ", too many %s header sections (%u)", name, num
	    ) == -1)
		return -1;
	return 0;
}

	    return 0;
	    return 0;
	uint16_t type, phnum, shnum;
CVE-2014-8117 (C, published 2014-12-17T19:59Z)
Description: value: softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/file/file
Files changed:
src/file.h
src/funcs.c
src/softmagic.c
Commit message: - reduce recursion level from 20 to 10 and make a symbolic constant for it.
- pull out the guts of saving and restoring the output buffer into functions
  and take care not to overwrite the error message if an error happened.


Vulnerable code:
 * @(#)$File: file.h,v 1.154 2014/09/10 18:41:51 christos Exp $
FILE_RCSID("@(#)$File: funcs.c,v 1.72 2014/05/14 23:15:42 christos Exp $")
FILE_RCSID("@(#)$File: softmagic.c,v 1.196 2014/11/07 15:24:14 christos Exp $")
	uint32_t soffset, offset = ms->offset;
	char *sbuf, *rbuf;
	if (recursion_level >= 20) {
		sbuf = ms->o.buf;
		soffset = ms->offset;
		ms->o.buf = NULL;
		ms->offset = 0;
		rbuf = ms->o.buf;
		ms->o.buf = sbuf;
		ms->offset = soffset;
		sbuf = m->value.s;
		if (*sbuf == '^') {
			sbuf++;
		if (file_magicfind(ms, sbuf, &ml) == -1) {
			file_error(ms, 0, "cannot find entry `%s'", sbuf);

Fixed code:
 * @(#)$File: file.h,v 1.155 2014/10/11 15:03:16 christos Exp $
typedef struct {
	char *buf;
	uint32_t offset;
} file_pushbuf_t;

protected file_pushbuf_t *file_push_buffer(struct magic_set *);
protected char  *file_pop_buffer(struct magic_set *, file_pushbuf_t *);

FILE_RCSID("@(#)$File: funcs.c,v 1.73 2014/09/10 18:41:51 christos Exp $")

protected file_pushbuf_t *
file_push_buffer(struct magic_set *ms)
{
	file_pushbuf_t *pb;

	if (ms->event_flags & EVENT_HAD_ERR)
		return NULL;

	if ((pb = (CAST(file_pushbuf_t *, malloc(sizeof(*pb))))) == NULL)
		return NULL;

	pb->buf = ms->o.buf;
	pb->offset = ms->offset;

	ms->o.buf = NULL;
	ms->offset = 0;

	return pb;
}

protected char *
file_pop_buffer(struct magic_set *ms, file_pushbuf_t *pb)
{
	char *rbuf;

	if (ms->event_flags & EVENT_HAD_ERR) {
		free(pb->buf);
		free(pb);
		return NULL;
	}

	rbuf = ms->o.buf;

	ms->o.buf = pb->buf;
	ms->offset = pb->offset;

	free(pb);
	return rbuf;
}
FILE_RCSID("@(#)$File: softmagic.c,v 1.197 2014/11/11 17:48:23 christos Exp $")

#define MAX_RECURSION_LEVEL	10

	uint32_t offset = ms->offset;
	file_pushbuf_t *pb;
	char *rbuf;
	if (recursion_level >= MAX_RECURSION_LEVEL) {


		if ((pb = file_push_buffer(ms)) == NULL)
			return -1;



		rbuf = file_pop_buffer(ms, pb);
		if (rbuf == NULL)
			return -1;

		rbuf = m->value.s;
		if (*rbuf == '^') {
			rbuf++;
		if (file_magicfind(ms, rbuf, &ml) == -1) {
			file_error(ms, 0, "cannot find entry `%s'", rbuf);
CVE-2014-9621 (C, published 2015-01-21T18:59Z)
Description: value: The ELF parser in file 5.16 through 5.21 allows remote attackers to cause a denial of service via a long string.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/file/file
Files changed:
src/readelf.c
Commit message: Limit string printing to 100 chars, and add flags I forgot in the previous
commit.


Vulnerable code:
FILE_RCSID("@(#)$File: readelf.c,v 1.115 2014/12/16 20:53:05 christos Exp $")
			if (file_printf(ms, ", compiled for: %.*s", (int)descsz,
			    (const char *)&nbuf[doff]) == -1)

Fixed code:
FILE_RCSID("@(#)$File: readelf.c,v 1.116 2014/12/16 23:18:40 christos Exp $")
		if (descsz > 100)
			descsz = 100;
			*flags |= FLAGS_DID_NETBSD_MARCH;
			if (file_printf(ms, ", compiled for: %.*s",
			    (int)descsz, (const char *)&nbuf[doff]) == -1)
			*flags |= FLAGS_DID_NETBSD_CMODEL;
			*flags |= FLAGS_DID_NETBSD_UNKNOWN;
CVE-2014-9652 (C, published 2015-03-30T10:59Z)
Description: value: The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/file/file
Files changed:
src/softmagic.c
Commit message: PR/398: Correctly truncate pascal strings (fixes out of bounds read of 1, 2,
or 4 bytes).


Vulnerable code:
FILE_RCSID("@(#)$File: softmagic.c,v 1.195 2014/09/24 19:49:07 christos Exp $")
		if (len >= sizeof(p->s)) {
			len = sizeof(p->s) - sz;

Fixed code:
FILE_RCSID("@(#)$File: softmagic.c,v 1.196 2014/11/07 15:24:14 christos Exp $")
		sz = sizeof(p->s) - sz; /* maximum length of string */
		if (len >= sz) {
			 * Because we can use one of the bytes of the length
			 * after we shifted as NUL termination.
			len = sz;