[File] [SECURITY] Integer Overflow in coalesce_entries() Leading to Heap Overflow (file-5.17)

[Kerwin]

Hi maintainers,

I am reporting an integer overflow vulnerability in libmagic (file-5.17)
where `coalesce_entries()` in apprentice.c accumulates continuation counts
into a `uint32_t` without overflow checking, allowing a crafted magic
database to wrap the counter and trigger an undersized `malloc()` followed
by a heap buffer overflow in the `memcpy` loop.

Please find the detailed vulnerability report and proof-of-concept files
attached.

Best regards
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.astron.com/pipermail/file/attachments/20260401/d664e978/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: POC.tar
Type: application/x-tar
Size: 2320896 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20260401/d664e978/attachment-0001.tar>