Index: php5-5.3.3/ext/fileinfo/libmagic/softmagic.c
===================================================================
--- php5-5.3.3.orig/ext/fileinfo/libmagic/softmagic.c	2014-09-28 22:49:37.000000000 +0200
+++ php5-5.3.3/ext/fileinfo/libmagic/softmagic.c	2014-09-28 22:49:37.000000000 +0200
@@ -56,7 +56,7 @@
 private int32_t moffset(struct magic_set *, struct magic *);
 private void mdebug(uint32_t, const char *, size_t);
 private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
-    const unsigned char *, uint32_t, size_t, size_t);
+    const unsigned char *, uint32_t, size_t, struct magic *);
 private int mconvert(struct magic_set *, struct magic *);
 private int print_sep(struct magic_set *, int);
 private int handle_annotation(struct magic_set *, struct magic *);
@@ -894,7 +894,7 @@
 
 private int
 mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
-    const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
+    const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
 {
 	/*
 	 * Note: FILE_SEARCH and FILE_REGEX do not actually copy
@@ -914,15 +914,24 @@
 			const char *last;	/* end of search region */
 			const char *buf;	/* start of search region */
 			const char *end;
-			size_t lines;
+			size_t lines, linecnt, bytecnt;
 
+			linecnt = m->str_range;
+			bytecnt = linecnt * 80;
+
+			if (bytecnt == 0) {
+				bytecnt = 8192;
+			}
+			if (bytecnt > nbytes) {
+				bytecnt = nbytes;
+			}
 			if (s == NULL) {
 				ms->search.s_len = 0;
 				ms->search.s = NULL;
 				return 0;
 			}
 			buf = (const char *)s + offset;
-			end = last = (const char *)s + nbytes;
+			end = last = (const char *)s + bytecnt;
 			/* mget() guarantees buf <= last */
 			for (lines = linecnt, b = buf;
 			     lines && ((b = memchr(c = b, '\n', end - b)) || (b = memchr(c, '\r', end - c)));
@@ -932,7 +941,7 @@
 					b++;
 			}
 			if (lines)
-				last = (const char *)s + nbytes;
+				last = (const char *)s + bytecnt;
 
 			ms->search.s = buf;
 			ms->search.s_len = last - buf;
@@ -1004,7 +1013,6 @@
     struct magic *m, size_t nbytes, unsigned int cont_level, int recursion_level)
 {
 	uint32_t offset = ms->offset;
-	uint32_t count = m->str_range;
 	union VALUETYPE *p = &ms->ms_value;
 
 	if (recursion_level >= 20) {
@@ -1012,10 +1020,13 @@
 		return -1;
 	}
 
-	if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, nbytes, count) == -1)
+	if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset,
+	    (uint32_t)nbytes, m) == -1)
 		return -1;
 
 	if ((ms->flags & MAGIC_DEBUG) != 0) {
+		fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, "
+		    "nbytes=%zu)\n", m->type, m->flag, offset, nbytes);
 		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
 	}
 
@@ -1496,7 +1507,7 @@
 		if (m->flag & INDIROFFADD) {
 			offset += ms->c.li[cont_level-1].off;
 		}
-		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
+		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
 			return -1;
 		ms->offset = offset;
 
@@ -1897,7 +1908,7 @@
 			zval *retval;
 			zval *subpats;
 			char *haystack;
-			
+
 			MAKE_STD_ZVAL(retval);
 			ALLOC_INIT_ZVAL(subpats);