File CVE-2025-1864.patch of Package radare2
From db6decd4bc90bb4a492129e70803136fa184f470 Mon Sep 17 00:00:00 2001
From: tabudz <64760144+tabudz@users.noreply.github.com>
Date: Thu, 20 Feb 2025 00:33:15 +0800
Subject: [PATCH] Fix memory corruption in libmagic - CVE-2015-8865 ##crash
* When the continuation level jumps by more than 20 in a single step
---
libr/magic/funcs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libr/magic/funcs.c b/libr/magic/funcs.c
index 7356dc0c93f77..52e3819f0e04e 100644
--- a/libr/magic/funcs.c
+++ b/libr/magic/funcs.c
@@ -322,7 +322,8 @@ const char *__magic_file_getbuffer(RMagic *ms) {
int __magic_file_check_mem(RMagic *ms, unsigned int level) {
if (level >= ms->c.len) {
- size_t len = (ms->c.len += 20) * sizeof (*ms->c.li);
+ ms->c.len = level + 20;
+ size_t len = ms->c.len * sizeof (*ms->c.li);
ms->c.li = (!ms->c.li) ? malloc (len) :
realloc (ms->c.li, len);
if (!ms->c.li) {