security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

Use inline functions to convert buffer data to scalars.

Browse source 
* include/host2net.h (buf16_to_ulong, buf16_to_uint): New.
(buf16_to_ushort, buf16_to_u16): New.
(buf32_to_size_t, buf32_to_ulong, buf32_to_uint, buf32_to_u32): New.
--

This fixes sign extension on shift problems.  Hanno Böck found a case
with an invalid read due to this problem.  To fix that almost all uses
of "<< 24" and "<< 8" are changed by this patch to use an inline
function from host2net.h.

(back ported from commit 2183683bd6)

Signed-off-by: Werner Koch <wk@gnupg.org>

[dkg: rebased to STABLE-BRANCH-1-4]
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
This commit is contained in:
Werner Koch 2015-02-21 23:10:32 -05:00
parent 7106165fd3
commit 57af33d9e7
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
12 changed files with 148 additions and 106 deletions
Download patch file Download diff file Expand all files Collapse all files

41
g10/parse-packet.c
View file

@ -35,6 +35,7 @@
#include "options.h"
#include "main.h"
#include "i18n.h"
#include "host2net.h"
#ifndef MAX_EXTERN_MPI_BITS
#define MAX_EXTERN_MPI_BITS 16384
@ -94,7 +95,7 @@ static unsigned short
read_16(IOBUF inp)
{
unsigned short a;
a = iobuf_get_noeof(inp) << 8;
a = (unsigned short)iobuf_get_noeof(inp) << 8;
a |= iobuf_get_noeof(inp);
return a;
}
@ -103,7 +104,7 @@ static unsigned long
read_32(IOBUF inp)
{
unsigned long a;
a = iobuf_get_noeof(inp) << 24;
a = (unsigned long)iobuf_get_noeof(inp) << 24;
a |= iobuf_get_noeof(inp) << 16;
a |= iobuf_get_noeof(inp) << 8;
a |= iobuf_get_noeof(inp);
@ -383,7 +384,8 @@ parse( IOBUF inp, PACKET *pkt, int onlykeypkts, off_t *retpos,
}
else if( c == 255 )
{
pktlen = (hdr[hdrlen++] = iobuf_get_noeof(inp)) << 24;
pktlen =
(unsigned long)(hdr[hdrlen++] = iobuf_get_noeof(inp)) << 24;
pktlen |= (hdr[hdrlen++] = iobuf_get_noeof(inp)) << 16;
pktlen |= (hdr[hdrlen++] = iobuf_get_noeof(inp)) << 8;
if( (c = iobuf_get(inp)) == -1 )
@ -878,14 +880,15 @@ dump_sig_subpkt( int hashed, int type, int critical,
switch( type ) {
case SIGSUBPKT_SIG_CREATED:
if( length >= 4 )
fprintf (listfp, "sig created %s", strtimestamp( buffer_to_u32(buffer) ) );
fprintf (listfp, "sig created %s",
strtimestamp (buf32_to_u32(buffer)) );
break;
case SIGSUBPKT_SIG_EXPIRE:
if( length >= 4 )
{
if(buffer_to_u32(buffer))
if(buf32_to_u32(buffer))
fprintf (listfp, "sig expires after %s",
strtimevalue( buffer_to_u32(buffer) ) );
strtimevalue( buf32_to_u32(buffer) ) );
else
fprintf (listfp, "sig does not expire");
}
@ -918,9 +921,9 @@ dump_sig_subpkt( int hashed, int type, int critical,
case SIGSUBPKT_KEY_EXPIRE:
if( length >= 4 )
{
if(buffer_to_u32(buffer))
if(buf32_to_u32(buffer))
fprintf (listfp, "key expires after %s",
strtimevalue( buffer_to_u32(buffer) ) );
strtimevalue( buf32_to_u32(buffer) ) );
else
fprintf (listfp, "key does not expire");
}
@ -943,8 +946,8 @@ dump_sig_subpkt( int hashed, int type, int critical,
case SIGSUBPKT_ISSUER:
if( length >= 8 )
fprintf (listfp, "issuer key ID %08lX%08lX",
(ulong)buffer_to_u32(buffer),
(ulong)buffer_to_u32(buffer+4) );
buf32_to_ulong (buffer),
buf32_to_ulong (buffer+4));
break;
case SIGSUBPKT_NOTATION:
{
@ -1192,8 +1195,7 @@ enum_sig_subpkt( const subpktarea_t *pktbuf, sigsubpkttype_t reqtype,
if( n == 255 ) { /* 4 byte length header */
if( buflen < 4 )
goto too_short;
n = (buffer[0] << 24) | (buffer[1] << 16)
| (buffer[2] << 8) | buffer[3];
n = buf32_to_size_t (buffer);
buffer += 4;
buflen -= 4;
}
@ -1415,7 +1417,7 @@ parse_signature( IOBUF inp, int pkttype, unsigned long pktlen,
p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_SIG_CREATED, NULL );
if(p)
sig->timestamp = buffer_to_u32(p);
sig->timestamp = buf32_to_u32 (p);
else if(!(sig->pubkey_algo>=100 && sig->pubkey_algo<=110)
&& opt.verbose)
log_info ("signature packet without timestamp\n");
@ -1423,16 +1425,16 @@ parse_signature( IOBUF inp, int pkttype, unsigned long pktlen,
p = parse_sig_subpkt2( sig, SIGSUBPKT_ISSUER, NULL );
if(p)
{
sig->keyid[0] = buffer_to_u32(p);
sig->keyid[1] = buffer_to_u32(p+4);
sig->keyid[0] = buf32_to_u32 (p);
sig->keyid[1] = buf32_to_u32 (p+4);
}
else if(!(sig->pubkey_algo>=100 && sig->pubkey_algo<=110)
&& opt.verbose)
log_info ("signature packet without keyid\n");
p=parse_sig_subpkt(sig->hashed,SIGSUBPKT_SIG_EXPIRE,NULL);
if(p && buffer_to_u32(p))
sig->expiredate=sig->timestamp+buffer_to_u32(p);
if(p && buf32_to_u32 (p))
sig->expiredate = sig->timestamp + buf32_to_u32 (p);
if(sig->expiredate && sig->expiredate<=make_timestamp())
sig->flags.expired=1;
@ -2032,9 +2034,8 @@ parse_attribute_subpkts(PKT_user_id *uid)
if( n == 255 ) { /* 4 byte length header */
if( buflen < 4 )
goto too_short;
n = (buffer[0] << 24) | (buffer[1] << 16)
| (buffer[2] << 8) | buffer[3];
buffer += 4;
n = buf32_to_size_t (buffer);
buffer += 4;
buflen -= 4;
}
else if( n >= 192 ) { /* 2 byte special encoded length header */