From 23ccad05c68005b580c7b209e2242bb93893af62 Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Fri, 16 May 2025 12:37:45 +0200
Subject: [PATCH] gpg: Do not allow compressed key packets on import.

* g10/import.c (read_block): Bail out on compressed packets.
* g10/options.h (COMPAT_COMPR_KEYS): New.
* g10/gpg.c (compatibility_flags): Add "compr-keys".
* common/util.h (GPG_ERR_UNEXPECTED_PACKET): Add a new replacement
code.
--

Compressed key packets do not make much sense but historically they
were supported.  Thus we also add a compatibility flag.

GnuPG-bug-id: 7014
Backported-from-master: 8e529f92219453195073d8a37670dbdf1f3a7e30
---
 common/util.h | 3 +++
 g10/gpg.c     | 1 +
 g10/import.c  | 7 ++++++-
 g10/options.h | 2 +-
 4 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/common/util.h b/common/util.h
index 803ab3d5c..27da89845 100644
--- a/common/util.h
+++ b/common/util.h
@@ -44,6 +44,9 @@
 # define GPG_ERR_NO_RESET_CODE    321
 # define GPG_ERR_BAD_RESET_CODE   322
 #endif
+#if GPGRT_VERSION_NUMBER  < 0x013800 /* 1.56 */
+# define GPG_ERR_UNEXPECTED_PACKET 216
+#endif
 
 #ifndef EXTERN_UNLESS_MAIN_MODULE
 # if !defined (INCLUDED_BY_MAIN_MODULE)
diff --git a/g10/gpg.c b/g10/gpg.c
index 1a96db989..28f47f80b 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -1037,6 +1037,7 @@ static struct debug_flags_s debug_flags [] =
 /* The list of compatibility flags.  */
 static struct compatibility_flags_s compatibility_flags [] =
   {
+    { COMPAT_COMPR_KEYS,   "compr-keys" },
     { 0, NULL }
   };
 
diff --git a/g10/import.c b/g10/import.c
index 9adda3e8c..ba62d2322 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -1057,7 +1057,12 @@ read_block( IOBUF a, unsigned int options,
       switch (pkt->pkttype)
         {
         case PKT_COMPRESSED:
-          if (check_compress_algo (pkt->pkt.compressed->algorithm))
+          if (!(opt.compat_flags & COMPAT_COMPR_KEYS))
+            {
+              rc = GPG_ERR_UNEXPECTED_PACKET;
+              goto ready;
+            }
+          else if (check_compress_algo (pkt->pkt.compressed->algorithm))
             {
               rc = GPG_ERR_COMPR_ALGO;
               goto ready;
diff --git a/g10/options.h b/g10/options.h
index 29641119d..62d667277 100644
--- a/g10/options.h
+++ b/g10/options.h
@@ -387,7 +387,7 @@ EXTERN_UNLESS_MAIN_MODULE int memory_debug_mode;
 EXTERN_UNLESS_MAIN_MODULE int memory_stat_debug_mode;
 
 /* Compatibility flags */
-/* #define COMPAT_FOO   1 */
+#define COMPAT_COMPR_KEYS     4  /* Allow import of compressed keys. (T7014) */
 
 
 /* Compliance test macors.  */