svn commit: r323278 - head/contrib/file/src

[Gordon Tetlow]

Author: gordon
Date: Thu Sep  7 18:54:54 2017
New Revision: 323278
URL: https://svnweb.freebsd.org/changeset/base/323278

Log:
  Fix an incorrectly used conditional causing a stack buffer overflow.
  
  Reported by:	Thomas Jarosch of Intra2net AG
  Reviewed by:	emaste, jhb
  Security:	CVE-2017-1000249

Modified:
  head/contrib/file/src/readelf.c

Modified: head/contrib/file/src/readelf.c
==============================================================================
--- head/contrib/file/src/readelf.c	Thu Sep  7 17:51:35 2017	(r323277)
+++ head/contrib/file/src/readelf.c	Thu Sep  7 18:54:54 2017	(r323278)
@@ -509,7 +509,7 @@ do_bid_note(struct magic_set *ms, unsigned char *nbuf,
     size_t noff, size_t doff, int *flags)
 {
 	if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 &&
-	    type == NT_GNU_BUILD_ID && (descsz >= 4 || descsz <= 20)) {
+	    type == NT_GNU_BUILD_ID && (descsz >= 4 && descsz <= 20)) {
 		uint8_t desc[20];
 		const char *btype;
 		uint32_t i;