security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-04-17 15:44:34 +02:00
Code Activity

Fix for Debian bug 402592

Browse Source
This commit is contained in:
Werner Koch 2007-02-04 17:20:24 +00:00
parent e0dbc52cfc
commit b4f553c1ca
2 changed files with 24 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
g10/ChangeLog
View File

@ -1,3 +1,8 @@
2007-02-04 Werner Koch <wk@g10code.com>
* parse-packet.c (parse_signature): Limit bytes read for an
unknown alogorithm. Fixes Debian bug#402592.
2007-02-01 David Shaw <dshaw@jabberwocky.com> 2007-02-01 David Shaw <dshaw@jabberwocky.com>
* main.h, keygen.c (ask_expire_interval, parse_expire_string): * main.h, keygen.c (ask_expire_interval, parse_expire_string):

20
g10/parse-packet.c
View File

@ -38,6 +38,11 @@
#include "main.h" #include "main.h"
#include "i18n.h" #include "i18n.h"
#ifndef MAX_EXTERN_MPI_BITS
#define MAX_EXTERN_MPI_BITS 16384
#endif
static int mpi_print_mode; static int mpi_print_mode;
static int list_mode; static int list_mode;
static FILE *listfp; static FILE *listfp;
@ -1437,11 +1442,22 @@ parse_signature( IOBUF inp, int pkttype, unsigned long pktlen,
if( list_mode ) if( list_mode )
fprintf (listfp, "\tunknown algorithm %d\n", sig->pubkey_algo ); fprintf (listfp, "\tunknown algorithm %d\n", sig->pubkey_algo );
unknown_pubkey_warning( sig->pubkey_algo ); unknown_pubkey_warning( sig->pubkey_algo );
/* we store the plain material in data[0], so that we are able /* We store the plain material in data[0], so that we are able
* to write it back with build_packet() */ * to write it back with build_packet() */
sig->data[0]= mpi_set_opaque(NULL, read_rest(inp, pktlen, 0), pktlen ); if (pktlen > (5 * MAX_EXTERN_MPI_BITS/8))
{
/* However we include a limit to avoid too trivial DoS
attacks by having gpg allocate too much memory. */
log_error ("signature packet: too much data\n");
rc = G10ERR_INVALID_PACKET;
}
else
{
sig->data[0]= mpi_set_opaque (NULL, read_rest(inp, pktlen, 0),
pktlen );
pktlen = 0; pktlen = 0;
} }
}
else { else {
for( i=0; i < ndata; i++ ) { for( i=0; i < ndata; i++ ) {
n = pktlen; n = pktlen;