security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-06-08 23:37:47 +02:00
Code Activity

gpg: Cap size of attribute packets at 16MB.

Browse Source 
* g10/parse-packet.c (parse_attribute): Avoid xmalloc failure and cap
size of packet.
--

Tavis Ormandy reported a fatal error for attribute packets with a zero
length payload.  This is due to a check in Libgcrypt's xmalloc which
rejects a malloc(0) instead of silently allocating 1 byte.  The fix is
obvious.

In addition we cap the size of attribute packets similar to what we do
with user id packets.  OpenPGP keys are not the proper way to store
movies.

Resolved conflicts:
	g10/parse-packet.c - indentation.  Use plain fprintf.
This commit is contained in:
Werner Koch 2014-07-21 13:50:36 +02:00
parent 40215d8ecd
commit 9a1e195348
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
g10/parse-packet.c
View File

@ -2214,11 +2214,22 @@ parse_attribute( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
(void)pkttype;
/* We better cap the size of an attribute packet to make DoS not
too easy. 16MB should be more then enough for one attribute
packet (ie. a photo). */
if (pktlen > 16*1024*1024) {
log_error ("packet(%d) too large\n", pkttype);
if (list_mode)
fprintf (listfp, ":attribute packet: [too large]\n");
iobuf_skip_rest (inp, pktlen, 0);
return G10ERR_INVALID_PACKET;
}
#define EXTRA_UID_NAME_SPACE 71
packet->pkt.user_id = xmalloc_clear(sizeof *packet->pkt.user_id
+ EXTRA_UID_NAME_SPACE);
packet->pkt.user_id->ref=1;
packet->pkt.user_id->attrib_data = xmalloc(pktlen);
packet->pkt.user_id->attrib_data = xmalloc(pktlen? pktlen:1);
packet->pkt.user_id->attrib_len = pktlen;
p = packet->pkt.user_id->attrib_data;