From 8305739fe857ed3378f885bb43777fd518dd1060 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Tue, 6 Feb 2018 17:34:08 +0100 Subject: [PATCH] gpg: Fix packet length checking in symkeyenc parser. * g10/parse-packet.c (parse_symkeyenc): Move error printing to the end. Add additional check to cope for the 0je extra bytes needed for AEAD. -- Fixes-commit: 9aab9167bca38323973e853845ca95ae8e9b6871 GnuPG-bug-id: 3780 --- g10/parse-packet.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/g10/parse-packet.c b/g10/parse-packet.c index 5c6d364ee..e3ff4321e 100644 --- a/g10/parse-packet.c +++ b/g10/parse-packet.c @@ -1108,13 +1108,7 @@ parse_symkeyenc (IOBUF inp, int pkttype, unsigned long pktlen, int i, version, s2kmode, cipher_algo, aead_algo, hash_algo, seskeylen, minlen; if (pktlen < 4) - { - log_error ("packet(%d) too short\n", pkttype); - if (list_mode) - es_fprintf (listfp, ":symkey enc packet: [too short]\n"); - rc = gpg_error (GPG_ERR_INV_PACKET); - goto leave; - } + goto too_short; version = iobuf_get_noeof (inp); pktlen--; if (version == 4) @@ -1146,6 +1140,8 @@ parse_symkeyenc (IOBUF inp, int pkttype, unsigned long pktlen, } else aead_algo = 0; + if (pktlen < 2) + goto too_short; s2kmode = iobuf_get_noeof (inp); pktlen--; hash_algo = iobuf_get_noeof (inp); @@ -1241,6 +1237,13 @@ parse_symkeyenc (IOBUF inp, int pkttype, unsigned long pktlen, leave: iobuf_skip_rest (inp, pktlen, 0); return rc; + + too_short: + log_error ("packet(%d) too short\n", pkttype); + if (list_mode) + es_fprintf (listfp, ":symkey enc packet: [too short]\n"); + rc = gpg_error (GPG_ERR_INV_PACKET); + goto leave; }