From 0988764397f99db4efef1eabcdb8072d6159af76 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Mon, 24 Nov 2014 17:28:25 +0100 Subject: [PATCH] gpg: Fix off-by-one read in the attribute subpacket parser. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * g10/parse-packet.c (parse_attribute_subpkts): Check that the attribute packet is large enough for the subpacket type. -- Reported-by: Hanno Böck Signed-off-by: Werner Koch --- g10/parse-packet.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/g10/parse-packet.c b/g10/parse-packet.c index e0370aaaa..f75e21ccb 100644 --- a/g10/parse-packet.c +++ b/g10/parse-packet.c @@ -2359,8 +2359,16 @@ parse_attribute_subpkts (PKT_user_id * uid) if (buflen < n) goto too_short; - attribs = - xrealloc (attribs, (count + 1) * sizeof (struct user_attribute)); + if (!n) + { + /* Too short to encode the subpacket type. */ + if (opt.verbose) + log_info ("attribute subpacket too short\n"); + break; + } + + attribs = xrealloc (attribs, + (count + 1) * sizeof (struct user_attribute)); memset (&attribs[count], 0, sizeof (struct user_attribute)); type = *buffer;