security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-31 11:41:32 +01:00
Code Activity

gpg: Fix bug parsing a zero length user id.

Browse Source 
* g10/getkey.c (get_user_id): Do not call xmalloc with 0.

* common/xmalloc.c (xmalloc, xcalloc): Take extra precaution not to
pass 0 to the arguments.
--

The problem did not occur in 1.x because over there the xmalloc makes
sure to allocate at least one byte.  With 2.x for most calls the
xmalloc of Libgcrypt is used and Libgcrypt returns an error insteead
of silent allocating a byte.  Thus gpg 2.x bailed out with an
"Fatal: out of core while allocating 0 bytes".

The extra code in xmalloc.c is for more robustness for the other
xmalloc calls.
This commit is contained in:
Werner Koch 2014-06-02 11:47:25 +02:00
parent 9e1c99f800
commit 99972bd6e9
2 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
common/xmalloc.c
View File

@ -47,7 +47,15 @@ out_of_core(void)
void *
xmalloc( size_t n )
{
void *p = malloc( n );
void *p;
/* Make sure that xmalloc (0) works. This is the same behaviour
has in gpg 2.x. Note that in contrast to this code, Libgcrypt
(and thus most xmallocs in gpg 2.x) detect the !n and bail out. */
if (!n)
n = 1;
p = malloc( n );
if( !p )
out_of_core();
return p;
@ -65,7 +73,14 @@ xrealloc( void *a, size_t n )
void *
xcalloc( size_t n, size_t m )
{
void *p = calloc( n, m );
void *p;
if (!n)
n = 1;
if (!m)
m = 1;
p = calloc( n, m );
if( !p )
out_of_core();
return p;

5
g10/getkey.c
View File

@ -2775,7 +2775,10 @@ get_user_id (u32 * keyid, size_t * rn)
{
if (a->keyid[0] == keyid[0] && a->keyid[1] == keyid[1])
{
p = xmalloc (r->len);
/* An empty string as user id is possible. Make
sure that the malloc allocates one byte and does
not bail out. */
p = xmalloc (r->len? r->len : 1);
memcpy (p, r->name, r->len);
*rn = r->len;
return p;