security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-05-14 08:13:25 +02:00
Code Activity

gpg: Fix a NULL-deref due to empty ring trust packets.

Browse Source 
* g10/parse-packet.c (parse_trust): Always allocate a packet.
--

Reported-by: Hanno Böck <hanno@hboeck.de>
Signed-off-by: Werner Koch <wk@gnupg.org>

(back ported from commit 39978487863066e59bb657f5fe4e8baab510da7e)

[dkg: rebased to STABLE-BRANCH-1-4]
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
This commit is contained in:
Werner Koch 2015-02-21 23:10:28 -05:00
parent 27d7addccf
commit 2e8db53854
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
g10/parse-packet.c
View File

@ -2245,11 +2245,13 @@ parse_trust( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *pkt )
{ {
int c; int c;
(void)pkttype;
pkt->pkt.ring_trust = xmalloc( sizeof *pkt->pkt.ring_trust );
if (pktlen) if (pktlen)
{ {
c = iobuf_get_noeof(inp); c = iobuf_get_noeof(inp);
pktlen--; pktlen--;
pkt->pkt.ring_trust = xmalloc( sizeof *pkt->pkt.ring_trust );
pkt->pkt.ring_trust->trustval = c; pkt->pkt.ring_trust->trustval = c;
pkt->pkt.ring_trust->sigcache = 0; pkt->pkt.ring_trust->sigcache = 0;
if (!c && pktlen==1) if (!c && pktlen==1)
@ -2267,6 +2269,8 @@ parse_trust( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *pkt )
} }
else else
{ {
pkt->pkt.ring_trust->trustval = 0;
pkt->pkt.ring_trust->sigcache = 0;
if (list_mode) if (list_mode)
fprintf (listfp, ":trust packet: empty\n"); fprintf (listfp, ":trust packet: empty\n");
} }