From 88317ae8c829bfeb1689415efbd32b7a232d7bd0 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Sun, 23 Aug 2015 12:17:43 +0200 Subject: [PATCH] gpg: Fix regression in packet parser from Aug 19. * g10/parse-packet.c (parse): Use an int to compare to -1. Use buf32_to_ulong. -- Regression-due-to: 0add91ae1ca3718e8140af09294c595f47c958d3 Signed-off-by: Werner Koch --- g10/parse-packet.c | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-) diff --git a/g10/parse-packet.c b/g10/parse-packet.c index edebbe782..4e236cb81 100644 --- a/g10/parse-packet.c +++ b/g10/parse-packet.c @@ -558,27 +558,20 @@ parse (IOBUF inp, PACKET * pkt, int onlykeypkts, off_t * retpos, else if (c == 255) { int i; - int eof = 0; char value[4]; for (i = 0; i < 4; i ++) - if ((value[i] = hdr[hdrlen++] = iobuf_get (inp)) == -1) - { - eof = 1; - break; - } - - if (eof) { - log_error ("%s: 4 byte length invalid\n", iobuf_where (inp)); - rc = gpg_error (GPG_ERR_INV_PACKET); - goto leave; + if ((c = iobuf_get (inp)) == -1) + { + log_error ("%s: 4 byte length invalid\n", iobuf_where (inp)); + rc = gpg_error (GPG_ERR_INV_PACKET); + goto leave; + } + value[i] = hdr[hdrlen++] = c; } - pktlen = (((unsigned long) value[0] << 24) - | ((unsigned long) value[1] << 16) - | ((unsigned long) value[2] << 8) - | ((unsigned long) value[3])); + pktlen = buf32_to_ulong (value); } else /* Partial body length. */ {