File CVE-2025-1864.patch of Package radare2

From db6decd4bc90bb4a492129e70803136fa184f470 Mon Sep 17 00:00:00 2001
From: tabudz <64760144+tabudz@users.noreply.github.com>
Date: Thu, 20 Feb 2025 00:33:15 +0800
Subject: [PATCH] Fix memory corruption in libmagic - CVE-2015-8865 ##crash

* When the continuation level jumps by more than 20 in a single step
---
 libr/magic/funcs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libr/magic/funcs.c b/libr/magic/funcs.c
index 7356dc0c93f77..52e3819f0e04e 100644
--- a/libr/magic/funcs.c
+++ b/libr/magic/funcs.c
@@ -322,7 +322,8 @@ const char *__magic_file_getbuffer(RMagic *ms) {
 
 int __magic_file_check_mem(RMagic *ms, unsigned int level) {
 	if (level >= ms->c.len) {
-		size_t len = (ms->c.len += 20) * sizeof (*ms->c.li);
+		ms->c.len = level + 20;
+		size_t len = ms->c.len * sizeof (*ms->c.li);
 		ms->c.li = (!ms->c.li) ? malloc (len) :
 		    realloc (ms->c.li, len);
 		if (!ms->c.li) {
openSUSE Build Service is sponsored by