security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-05-24 16:43:28 +02:00
Code Activity

Parse v5 signature subpacket.

Browse Source 
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
This commit is contained in:
NIIBE Yutaka 2022-04-12 15:18:53 +09:00
parent bdb5136518
commit 412c8fcdfd
1 changed files with 24 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
g10/parse-packet.c
View File

@ -2188,10 +2188,18 @@ parse_signature (IOBUF inp, int pkttype, unsigned long pktlen,
sig->flags.revocable = 1; sig->flags.revocable = 1;
if (is_v4or5) /* Read subpackets. */ if (is_v4or5) /* Read subpackets. */
{ {
if (pktlen < 2) if (pktlen < 2 || (sig->version == 5 && pktlen < 4))
goto underflow; goto underflow;
n = read_16 (inp); if (sig->version == 5)
pktlen -= 2; /* Length of hashed data. */ {
n = read_32 (inp);
pktlen -= 4; /* Length of hashed data. */
}
else
{
n = read_16 (inp);
pktlen -= 2; /* Length of hashed data. */
}
if (pktlen < n) if (pktlen < n)
goto underflow; goto underflow;
if (n > 10000) if (n > 10000)
@ -2218,10 +2226,18 @@ parse_signature (IOBUF inp, int pkttype, unsigned long pktlen,
} }
pktlen -= n; pktlen -= n;
} }
if (pktlen < 2) if (pktlen < 2 || (sig->version == 5 && pktlen < 4))
goto underflow; goto underflow;
n = read_16 (inp); if (sig->version == 5)
pktlen -= 2; /* Length of unhashed data. */ {
n = read_32 (inp);
pktlen -= 4; /* Length of unhashed data. */
}
else
{
n = read_16 (inp);
pktlen -= 2; /* Length of unhashed data. */
}
if (pktlen < n) if (pktlen < n)
goto underflow; goto underflow;
if (n > 10000) if (n > 10000)