security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

Use inline functions to convert buffer data to scalars.

Browse source 
* common/host2net.h (buf16_to_ulong, buf16_to_uint): New.
(buf16_to_ushort, buf16_to_u16): New.
(buf32_to_size_t, buf32_to_ulong, buf32_to_uint, buf32_to_u32): New.
--

Commit 91b826a388 was not enough to
avoid all sign extension on shift problems.  Hanno Böck found a case
with an invalid read due to this problem.  To fix that once and for
all almost all uses of "<< 24" and "<< 8" are changed by this patch to
use an inline function from host2net.h.

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2015-02-11 10:27:57 +01:00
parent f0f71a721c
commit 2183683bd6
31 changed files with 220 additions and 210 deletions
Download patch file Download diff file Expand all files Collapse all files

7
g13/mount.c
View file

@ -37,6 +37,7 @@
#include "call-gpg.h"
#include "mountinfo.h"
#include "runner.h"
#include "host2net.h"
/* Parse the header prefix and return the length of the entire header. */
@ -50,8 +51,7 @@ parse_header (const char *filename,
if (packetlen != 32)
return gpg_error (GPG_ERR_BUG);
len = ((packet[2] << 24) | (packet[3] << 16)
| (packet[4] << 8) | packet[5]);
len = buf32_to_uint (packet+2);
if (packet[0] != (0xc0|61) || len < 26
|| memcmp (packet+6, "GnuPG/G13", 10))
{
@ -76,8 +76,7 @@ parse_header (const char *filename,
return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
}
len = ((packet[20] << 24) | (packet[21] << 16)
| (packet[22] << 8) | packet[23]);
len = buf32_to_uint (packet+20);
/* Do a basic sanity check on the length. */
if (len < 32 || len > 1024*1024)