security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-04-17 15:44:34 +02:00
Code Activity

gpg: Fix possible out-of-bounds read in is_armored.

Browse Source 
* g10/armor.c (check_input): Call is_armored only if LEN >= 2.
(unarmor_pump): Use a 2 byte buffer for is_armored.
--

Fixes-commit: 605276ef8cd449bfd574ae6c498fa5d7d265c5c7
Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2016-07-05 18:49:06 +02:00
parent 8270580a5a
commit 5d1a9c4dc8
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
g10/armor.c
View File

@ -190,9 +190,14 @@ initialize(void)
is_initialized=1; is_initialized=1;
} }
/****************
* Check whether this is an armored file or not See also /*
* Check whether this is an armored file. See also
* parse-packet.c for details on this code. * parse-packet.c for details on this code.
*
* Note that the buffer BUF needs to be at least 2 bytes long. If in
* doubt that the second byte to 0.
*
* Returns: True if it seems to be armored * Returns: True if it seems to be armored
*/ */
static int static int
@ -532,7 +537,7 @@ check_input( armor_filter_context_t *afx, IOBUF a )
/* (the line is always a C string but maybe longer) */ /* (the line is always a C string but maybe longer) */
if( *line == '\n' || ( len && (*line == '\r' && line[1]=='\n') ) ) if( *line == '\n' || ( len && (*line == '\r' && line[1]=='\n') ) )
; ;
else if( !is_armored( line ) ) { else if (len >= 2 && !is_armored (line)) {
afx->inp_checked = 1; afx->inp_checked = 1;
afx->inp_bypass = 1; afx->inp_bypass = 1;
return 0; return 0;
@ -1411,8 +1416,9 @@ unarmor_pump (UnarmorPump x, int c)
switch (x->state) { switch (x->state) {
case STA_init: case STA_init:
{ {
byte tmp[1]; byte tmp[2];
tmp[0] = c; tmp[0] = c;
tmp[1] = 0;
if ( is_armored (tmp) ) if ( is_armored (tmp) )
x->state = c == '-'? STA_first_dash : STA_wait_newline; x->state = c == '-'? STA_first_dash : STA_wait_newline;
else { else {