security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-11-04 20:38:50 +01:00
Code Activity

gpg: Fix a NULL-deref due to empty ring trust packets.

Browse Source 
* g10/parse-packet.c (parse_trust): Always allocate a packet.
--

Reported-by: Hanno Böck <hanno@hboeck.de>
Signed-off-by: Werner Koch <wk@gnupg.org>

(back ported from commit 3997848786)
This commit is contained in:
Werner Koch 2015-02-12 18:52:07 +01:00
parent a55c212538
commit 7e12ec4c7d
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
g10/parse-packet.c
View File

@ -2324,11 +2324,11 @@ parse_trust( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *pkt )
(void)pkttype; (void)pkttype;
pkt->pkt.ring_trust = xmalloc( sizeof *pkt->pkt.ring_trust );
if (pktlen) if (pktlen)
{ {
c = iobuf_get_noeof(inp); c = iobuf_get_noeof(inp);
pktlen--; pktlen--;
pkt->pkt.ring_trust = xmalloc( sizeof *pkt->pkt.ring_trust );
pkt->pkt.ring_trust->trustval = c; pkt->pkt.ring_trust->trustval = c;
pkt->pkt.ring_trust->sigcache = 0; pkt->pkt.ring_trust->sigcache = 0;
if (!c && pktlen==1) if (!c && pktlen==1)
@ -2346,8 +2346,10 @@ parse_trust( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *pkt )
} }
else else
{ {
if( list_mode ) pkt->pkt.ring_trust->trustval = 0;
fprintf (listfp, ":trust packet: empty\n"); pkt->pkt.ring_trust->sigcache = 0;
if (list_mode)
fprintf (listfp, ":trust packet: empty\n");
} }
iobuf_skip_rest (inp, pktlen, 0); iobuf_skip_rest (inp, pktlen, 0);
} }