Code:  cdf_read_sector(const cdf_info_t *info, void *buf, size_t offs, size_t len,
     const cdf_header_t *h, cdf_secid_t id)
 {
	assert((size_t)CDF_SEC_SIZE(h) == len);
	return cdf_read(info, (off_t)CDF_SEC_POS(h, id),
	    ((char *)buf) + offs, len);
 }

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference.
Commit Message: add more check found by cert's fuzzer.