security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-02 22:46:30 +02:00
Code Activity

gpg: Fix double free with anonymous recipients.

Browse source 
* g10/pubkey-enc.c (get_session_key): Do not release SK.
--

Bug is in 2.2.18 only.

The semantics of the enum_secret_keys function changed in master.
When back porting this for 2.2.18 I missed this change and thus we ran
into a double free.  The patches fixes the regression but is it clumsy.
We need to change the enum_secret_keys interface to avoid such a
surprising behaviour; this needs to be done in master first.

Regression-due-to: 9a317557c5
GnuPG-bug-id: 4762
Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2019-11-29 17:44:12 +01:00
parent 80971adbc1
commit 9ac182f376
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
2 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
g10/pubkey-enc.c
View file

@ -114,11 +114,11 @@ get_session_key (ctrl_t ctrl, PKT_pubkey_enc * k, DEK * dek)
for (;;)
{
free_public_key (sk);
sk = xmalloc_clear (sizeof *sk);
rc = enum_secret_keys (ctrl, &enum_context, sk);
if (rc)
{
sk = NULL; /* enum_secret_keys turns SK into a shallow copy! */
rc = GPG_ERR_NO_SECKEY;
break;
}
@ -148,10 +148,14 @@ get_session_key (ctrl_t ctrl, PKT_pubkey_enc * k, DEK * dek)
{
if (!opt.quiet)
log_info (_("okay, we are the anonymous recipient.\n"));
sk = NULL;
break;
}
else if (gpg_err_code (rc) == GPG_ERR_FULLY_CANCELED)
break; /* Don't try any more secret keys. */
{
sk = NULL;
break; /* Don't try any more secret keys. */
}
}
enum_secret_keys (ctrl, &enum_context, NULL); /* free context */
}