security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-01-10 13:04:23 +01:00
Code Activity

gpg: Fix a NULL-deref in export due to invalid packet lengths.

Browse Source 
* g10/build-packet.c (write_fake_data): Take care of a NULL stored as
opaque MPI.
--

Reported-by: Hanno Böck <hanno@hboeck.de>

Test data:

     gpg2 --no-default-keyring --keyring FILE --export

With this unpacked data for FILE:

-----BEGIN PGP ARMORED FILE-----
Version: GnuPG v2
Comment: Use "gpg --dearmor" for unpacking

mI0EGRkZGRkZGRkZGRkZGRkBGRkZGRkZGRkZGRkZGQAZGRkZGRkZGRkZGRkZGRkZ
GRkZInzgDbpa/9gQ4wq9////f3Vy81CkyVq3HQaqgZLZOeqPjM7XgGh5hJvAkpec
9wAAAgDHe0FVFbkppJZXP+gFs6z3gobS0qUFeyTtxs+wAgAD
=JDFT
-----END PGP ARMORED FILE-----

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2015-02-09 10:54:06 +01:00
parent 3997848786
commit 0835d2f44e
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
g10/build-packet.c
View File

@ -261,6 +261,9 @@ write_fake_data (IOBUF out, gcry_mpi_t a)
if (!a) if (!a)
return 0; return 0;
p = gcry_mpi_get_opaque ( a, &n); p = gcry_mpi_get_opaque ( a, &n);
if (!p)
return 0; /* For example due to a read error in
parse-packet.c:read_rest. */
return iobuf_write (out, p, (n+7)/8 ); return iobuf_write (out, p, (n+7)/8 );
} }
@ -305,9 +308,9 @@ do_key (iobuf_t out, int ctb, PKT_public_key *pk)
nskey = pubkey_get_nskey (pk->pubkey_algo); nskey = pubkey_get_nskey (pk->pubkey_algo);
npkey = pubkey_get_npkey (pk->pubkey_algo); npkey = pubkey_get_npkey (pk->pubkey_algo);
/* If we don't have any public parameters - which is the case if we /* If we don't have any public parameters - which is for example the
don't know the algorithm used - the parameters are stored as one case if we don't know the algorithm used - the parameters are
blob in a faked (opaque) MPI. */ stored as one blob in a faked (opaque) MPI. */
if (!npkey) if (!npkey)
{ {
write_fake_data (a, pk->pkey[0]); write_fake_data (a, pk->pkey[0]);