security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-06-09 23:39:51 +02:00
Code Activity

gpg: Fix a NULL-deref due to empty ring trust packets.

Browse Source 
* g10/parse-packet.c (parse_trust): Always allocate a packet.
--

Reported-by: Hanno Böck <hanno@hboeck.de>
Signed-off-by: Werner Koch <wk@gnupg.org>

(back ported from commit 3997848786)
This commit is contained in:
Werner Koch 2015-02-12 18:52:07 +01:00
parent a55c212538
commit 7e12ec4c7d
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
g10/parse-packet.c
View File

@ -2324,11 +2324,11 @@ parse_trust( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *pkt )
(void)pkttype;
pkt->pkt.ring_trust = xmalloc( sizeof *pkt->pkt.ring_trust );
if (pktlen)
{
c = iobuf_get_noeof(inp);
pktlen--;
pkt->pkt.ring_trust = xmalloc( sizeof *pkt->pkt.ring_trust );
pkt->pkt.ring_trust->trustval = c;
pkt->pkt.ring_trust->sigcache = 0;
if (!c && pktlen==1)
@ -2346,8 +2346,10 @@ parse_trust( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *pkt )
}
else
{
if( list_mode )
fprintf (listfp, ":trust packet: empty\n");
pkt->pkt.ring_trust->trustval = 0;
pkt->pkt.ring_trust->sigcache = 0;
if (list_mode)
fprintf (listfp, ":trust packet: empty\n");
}
iobuf_skip_rest (inp, pktlen, 0);
}