security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-05-28 21:50:02 +02:00
Code Activity

gpg: Make sure a DECRYPTION_OKAY is never issued for a bad OCB tag.

Browse Source 
* g10/mainproc.c (proc_encrypted): Force a decryption failure if any
error has been seen.
* g10/decrypt-data.c (aead_checktag): Issue an ERROR line.
--

GnuPG-bug-id: 7042

Note that gpg in any case returns a failure exit code but due to
double forking GPGME would not see it.
This commit is contained in:
Werner Koch 2024-03-14 21:41:15 +01:00
parent 509d0f76ce
commit 82b39fe254
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
g10/decrypt-data.c
View File

@ -206,6 +206,7 @@ aead_checktag (decode_filter_ctx_t dfx, int final, const void *tagbuf)
{
log_error ("gcry_cipher_checktag%s failed: %s\n",
final? " (final)":"", gpg_strerror (err));
write_status_error ("aead_checktag", err);
return err;
}
if (DBG_FILTER)

6
g10/mainproc.c
View File

@ -821,9 +821,13 @@ proc_encrypted (CTX c, PACKET *pkt)
compliance_de_vs |= 2;
}
/* Trigger the deferred error. */
/* Trigger the deferred error. The second condition makes sure that a
* log_error printed in the cry_cipher_checktag never gets ignored. */
if (!result && early_plaintext)
result = gpg_error (GPG_ERR_BAD_DATA);
else if (!result && pkt->pkt.encrypted->aead_algo
&& log_get_errorcount (0))
result = gpg_error (GPG_ERR_BAD_SIGNATURE);
if (result == -1)
;