1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-23 10:29:58 +01:00

4011 Commits

Author SHA1 Message Date
Werner Koch
a838e8f806 agent: Fix length test in sshcontrol parser.
* agent/command-ssh.c (ssh_search_control_file): Check S before
upcasing it.
--

In contradiction to the comment we did not check the length of HEXGRIP
and thus the GPG_ERR_INV_LENGTH was never triggered.

Detected by Stack 0.3:

  bug: anti-simplify
  model: |
    %cmp8 = icmp ne i32 %i.0, 40, !dbg !986
    -->  false
  stack:
    - /home/wk/s/gnupg/agent/command-ssh.c:1226:0
  ncore: 2
  core:
    - /home/wk/s/gnupg/agent/command-ssh.c:1225:0
      - buffer overflow
    - /home/wk/s/gnupg/agent/command-ssh.c:1225:0
      - buffer overflow

(backported from 2.1 commit 3529dd8bb5bafc4e02915648d5f409bd27a9cc37)
2015-04-15 16:07:08 +09:00
Werner Koch
b4ec909186 scd: Fix possible NULL deref in apdu.c
* scd/apdu.c (control_pcsc_direct): Take care of BUFLEN being NULL.
(control_pcsc_wrapped): Ditto.
--

pcsc_vendor_specific_init calls the above with BUFFER and BUFLEN as
NULL.

Reported by Stack 0.3:

  bug: anti-dce
  model: |
    control_pcsc.exit77:
    %retval.0.i.i76 = phi i32 [ %rc.0.i.i.i73, \
            %pcsc_error_to_sw.exit.i.i74 ], [ 0, %if.end.i.i75 ]
    %tobool198 = icmp ne i32 %retval.0.i.i76, 0, !dbg !728
    br i1 %tobool198, label %if.then199, label %if.end200, !dbg !728
  stack:
    - /home/wk/s/gnupg/scd/apdu.c:1882:0
  ncore: 1
  core:
    - /home/wk/s/gnupg/scd/apdu.c:1309:0
      - buffer overflow

(backported from 2.1 commit ef0a3abf7305133d071bf1a94a7f461082f9a9aa)
2015-04-15 16:06:06 +09:00
NIIBE Yutaka
067b6360be po: Update Japanese translation. 2015-04-15 13:41:48 +09:00
Werner Koch
0aac920f23
gpg: Fix DoS while parsing mangled secret key packets.
* g10/parse-packet.c (parse_key): Check PKTLEN before calling mpi_read
et al.
--

Due to the missing length checks PKTLEN may turn negative.  Because
PKTLEN is an unsigned int the malloc in read_rest would try to malloc
a too large number and terminate the process with "error reading rest
of packet: Cannot allocate memory".

Reported-by: Hanno Böck.
Signed-off-by: Werner Koch <wk@gnupg.org>
(backported from 2.1 commit d901efcebaefaf6eae4a9b9aa8f0c2c055d3518a)
2015-04-05 19:33:36 +02:00
Werner Koch
2a2da1b165
doc: Document the changed default algos for gpgsm.
--
2015-03-25 10:26:26 +01:00
Werner Koch
bdf439035d
sm: Change default algos to SHA256 (CSR) and AES128 (bulk encryption).
* sm/certreqgen.c (create_request): Change default hash algo.
* sm/gpgsm.c (main): Change default bulk cipher algo.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-03-25 10:26:08 +01:00
Andre Heinecke
0ed2cfcf05
gpgtar: Fix extracting files with !(size % 512)
* tools/gpgtar-extract.c (extract_regular): Handle size multiples
  of RECORDSIZE.

--
  If a hdr->size was a multiple of 512 the last record would
  not have been written and the files corrupted accordingly.

GnuPG-bug-id: 1926

Signed-off-by: Andre Heinecke <aheinecke@intevation.de>

Changed to use only if-else.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 6cbbb0bec98e1acefc4c7163cc41a507469db920)
2015-03-17 12:03:36 +01:00
Werner Koch
25e2b27b00
common: Check option arguments for a valid range
* common/argparse.h (ARGPARSE_INVALID_ARG): New.
* common/argparse.c: Include limits h and errno.h.
(initialize): Add error strings for new error constant.
(set_opt_arg): Add range checking.
--
Signed-off-by: Werner Koch <wk@gnupg.org>

[ This is a backport of 0d73a242cb53522669cf712b5ece7d1ed05d003a from
  master to STABLE-BRANCH-2-0 ]

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2015-03-11 15:02:30 +01:00
Werner Koch
2f3de06ff4
gpg: New command --list-gcrypt-config.
* g10/gpg.c (aListGcryptConfig): New.
(main): Implement command.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-03-11 14:59:25 +01:00
Werner Koch
936416690e
gpg: Remove left-over debug message.
* g10/armor.c (check_input): Remove log_debug.
2015-02-26 09:38:58 +01:00
Werner Koch
24d8c00e6e Post release updates.
--
2015-02-18 14:32:11 +01:00
Werner Koch
8d47e6e523 Release 2.0.27 gnupg-2.0.27 2015-02-18 14:20:23 +01:00
Werner Koch
be91b2f89e gpg: Remove an unused variable.
* g10/import.c (import): Remove need_armor.
2015-02-18 14:20:21 +01:00
Werner Koch
3d6c262e21 po: Auto update
--
2015-02-18 14:20:12 +01:00
Werner Koch
c3bcbe1fb5 po: Update German translation 2015-02-18 12:52:55 +01:00
Daniel Kahn Gillmor
839727503d curl-shim: clean up varargs
* keyserver/curl-shim.c (curl_easy_setopt) : ensure that va_end is
  called.

--

stdarg(3) says:
      Each invocation of va_start() must be matched by a
      corresponding invocation of va_end() in the same function.

Observed by Joshua Rogers <honey@internot.info>

Debian-Bug-Id: #773475
2015-02-18 12:26:11 +01:00
Werner Koch
0c3d7645df gpg: Print better diagnostics for keyserver operations.
* g10/armor.c (parse_key_failed_line): New.
(check_input): Watch out for gpgkeys_ error lines.
* g10/filter.h (armor_filter_context_t): Add field key_failed_code.
* g10/import.c (import): Add arg r_gpgkeys_err.
(import_keys_internal): Ditto.
(import_keys_stream): Ditto.
* g10/keyserver.c (keyserver_errstr): New.
(keyserver_spawn): Detect "KEY " lines while sending.  Get gpgkeys_err
while receiving keys.
(keyserver_work): Add kludge for better error messages.
--

GnuPG-bug-id: 1832

Note that these changes can be backported to 1.4 but they don't make
sense for 2.1 due to the removal of the keyserver helpers.  The error
reporting could be improved even more but given that this is an old
GnuPG branch it is not justified to put too much effort into it.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-02-18 12:14:22 +01:00
Werner Koch
cb2ee2dc50 keyserver: Show log prefix when not build with cURL.
* keyserver/ksutil.c (init_ks_options) [!HAVE_LIBCURL]: Set logging
prefix.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-02-13 11:37:17 +01:00
Werner Koch
3627123dc8 Use inline functions to convert buffer data to scalars.
* include/host2net.h (buf16_to_ulong, buf16_to_uint): New.
(buf16_to_ushort, buf16_to_u16): New.
(buf32_to_size_t, buf32_to_ulong, buf32_to_uint, buf32_to_u32): New.
--

This fixes sign extension on shift problems.  Hanno Böck found a case
with an invalid read due to this problem.  To fix that almost all uses
of "<< 24" and "<< 8" are changed by this patch to use an inline
function from host2net.h.

(back ported from commit 2183683bd633818dd031b090b5530951de76f392)

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-02-12 20:34:44 +01:00
Werner Koch
b62395cf59 build: Update standard build-aux files.
--
2015-02-12 19:39:12 +01:00
Werner Koch
d192ab790c doc: Change remaining http links to gnupg.org to https
--
GnuPG-bug-id: 1830
2015-02-12 19:32:19 +01:00
Werner Koch
824d88ac51 gpg: Prevent an invalid memory read using a garbled keyring.
* g10/keyring.c (keyring_get_keyblock): Whitelist allowed packet
types.
--

The keyring DB code did not reject packets which don't belong into a
keyring.  If for example the keyblock contains a literal data packet
it is expected that the processing code stops at the data packet and
reads from the input stream which is referenced from the data packets.
Obviously the keyring processing code does not and cannot do that.
However, when exporting this messes up the IOBUF and leads to an
invalid read of sizeof (int).

We now skip all packets which are not allowed in a keyring.

Reported-by: Hanno Böck <hanno@hboeck.de>

(back ported from commit f0f71a721ccd7ab9e40b8b6b028b59632c0cc648)
2015-02-12 18:58:36 +01:00
Werner Koch
8da836e76f gpg: Fix a NULL-deref in export due to invalid packet lengths.
* g10/build-packet.c (write_fake_data): Take care of a NULL stored as
opaque MPI.
--

Reported-by: Hanno Böck <hanno@hboeck.de>

(back ported from commit 0835d2f44ef62eab51fce6a927908f544e01cf8f)
2015-02-12 18:54:17 +01:00
Werner Koch
7e12ec4c7d gpg: Fix a NULL-deref due to empty ring trust packets.
* g10/parse-packet.c (parse_trust): Always allocate a packet.
--

Reported-by: Hanno Böck <hanno@hboeck.de>
Signed-off-by: Werner Koch <wk@gnupg.org>

(back ported from commit 39978487863066e59bb657f5fe4e8baab510da7e)
2015-02-12 18:52:07 +01:00
Joshua Rogers
a55c212538 kbx: Fix resource leak.
* kbx/keybox-update.c (blob_filecopy): Fix resource leak.  On error
return, 'fp' and 'newfp' was never closed.

--

Signed-off-by: Joshua Rogers <git@internot.info>

[Log entry reformatted, and added more fixes - gniibe]

(cherry picked from commit 7db6c82cec49b7c56c403a8ea98364086baf75f3)
2015-02-12 18:46:03 +01:00
Werner Koch
2b2adb8594 gpg: Limit the size of key packets to a sensible value.
* g10/parse-packet.c (MAX_KEY_PACKET_LENGTH): New.
(MAX_UID_PACKET_LENGTH): New.
(MAX_COMMENT_PACKET_LENGTH): New.
(MAX_ATTR_PACKET_LENGTH): New.
(parse_key): Limit the size of a key packet to 256k.
(parse_user_id): Use macro for the packet size limit.
(parse_attribute): Ditto.
(parse_comment): Ditto.
--

Without that it is possible to force gpg to allocate large amounts of
memory by using a bad encoded MPI.  This would be an too easy DoS.
Another way to mitigate would be to change the MPI read function to
allocate memory dynamically while reading the MPI.  However, that
complicates and possibly slows down the code.  A too large key packet
is in any case a sign for broken data and thus gpg should not use it.

Reported-by: Hanno Böck
GnuPG-bug-id: 1823
Signed-off-by: Werner Koch <wk@gnupg.org>

(back ported from commit 382ba4b137b42d5f25a7e256bb7c053ee5ac7b64)
2015-02-12 18:45:08 +01:00
Werner Koch
f256bab03e Avoid double-close in unusual dotlock situations.
* jnlib/dotlock.c (create_dotlock): Avoid double close due to EINTR.
--

close(2) says:

  close() should not be retried after an EINTR since this may cause a
  reused descriptor from another thread to be closed.

(backported from commit 628b111fa679612e23c0d46505b1ecbbf091897d)

Debian-Bug-Id: 773423
Signed-off-by: Werner Koch <wk@gnupg.org>
2015-02-12 18:26:58 +01:00
Werner Koch
b2359db21c gpg: Allow predefined names as answer to the keygen.algo prompt.
* g10/keygen.c (ask_algo): Add list of strings.

--
Signed-off-by: Werner Koch <wk@gnupg.org>
(backported from commit b1d5ed6ac842469afcb84868d0f6641dc286a6c7)
2015-01-28 09:24:20 +01:00
Werner Koch
2424028fd9 gpg: Print a warning if the subkey expiration may not be what you want.
* g10/keyedit.c (subkey_expire_warning): New.
keyedit_menu): Call it when needed.
--
GnuPG-bug-id: 1715

The heuristic to detect a problem is not very advanced but it should
catch the most common cases.

(backported from commit ae3d1bbb65b65cf3c57bb14886be120f5e31635d)
2015-01-26 14:55:24 +01:00
Werner Koch
01d6902839 build: Update to gettext 0.19.3. 2015-01-26 14:31:55 +01:00
Werner Koch
c25513cc1b build: Require automake 1.14.
* Makefile.am (AUTOMAKE_OPTIONS): Move to ...
* configure.ac (AM_INIT_AUTOMAKE): here.  Add option serial-tests.
* kbx/Makefile.am (INCLUDES): Remove.  Include ../am/cmacros.
2015-01-26 14:31:49 +01:00
Jedi Lin
43deed7359 po: Yet another update for Chinese (traditional) 2015-01-26 12:10:04 +01:00
Joshua Rogers
3d9f8bf1dc Remove incorrect expression leading to errors.
* scd/ccid-driver.c (send_escape_cmd): Fix setting of 'rc'.
--

Variable 'rc' in send_escape_cmd was overwritten before it was
returned, leading to incorrect computation.

Signed-off-by: Joshua Rogers <git@internot.info>

[Log entry reformatted - wk]
2015-01-25 10:38:26 +01:00
Werner Koch
068ec6c8ed gpgconf: Fix validity check for UINT32 values.
* tools/gpgconf-comp.c (option_check_validity): Enable check for
UINT32.
--

Reported-by: Günther Noack <gnoack@google.com>

This is actually a bug which inhibited the checking of values of type
UINT32.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 3f6abb57a7b5e54b593c5775c8f7a07d61119705)
2015-01-23 15:39:50 +01:00
Joshua Rogers
1298b14f97 tools: Free variable before return
* tools/gpgconf-comp.c: Free 'dest_filename' before it is returned
upon error.
--

Signed-off-by: Joshua Rogers <git@internot.info>
2015-01-13 10:52:23 +09:00
Daniel Kahn Gillmor
ced689e12a sm: Avoid double-free on iconv failure
* sm/minip12.c: (p12_build) if jnlib_iconv_open fails, avoid
double-free of pwbuf.

--

Observed by Joshua Rogers <honey@internot.info>, who proposed a
slightly different fix.

Debian-Bug-Id: 773472

Added fix at a second place - wk.
2015-01-13 10:52:22 +09:00
Daniel Kahn Gillmor
0fd4cd8503 scd: Avoid double-free on error condition in scd
* scd/command.c (cmd_readkey): avoid double-free of cert

--

When ksba_cert_new() fails, cert will be double-freed.

Debian-Bug-Id: 773471

Original patch changed by wk to do the free only at leave.
2015-01-13 10:52:22 +09:00
Daniel Kahn Gillmor
1fc4dc541a avoid future chance of using uninitialized memory
* common/iobuf.c: (iobuf_open): initialize len

--

In iobuf_open, IOBUFCTRL_DESC and IOBUFCTRL_INIT commands are invoked
(via file_filter()) on fcx, passing in a pointer to an uninitialized
len.

With these two commands, file_filter doesn't actually do anything with
the value of len, so there's no actual risk of use of uninitialized
memory in the code as it stands.

However, some static analysis tools might flag this situation with a
warning, and initializing the value doesn't hurt anything, so i think
this trivial cleanup is warranted.

Debian-Bug-Id: 773469
2015-01-13 10:52:22 +09:00
Daniel Kahn Gillmor
f542826b04 gpgkey2ssh: clean up varargs
* tools/gpgkey2ssh.c (key_to_blob) : ensure that va_end is called.

--

stdarg(3) says:
       Each invocation of va_start() must be matched by a
       corresponding invocation of va_end() in the same function.

Observed by Joshua Rogers <honey@internot.info>

Debian-Bug-Id: 773415
2015-01-13 10:52:21 +09:00
Werner Koch
01b364b6da doc: Fix memory leak in yat2m.
* doc/yat2m.c (write_th): Free NAME.
--

Reported-by: Joshua Rogers <git@internot.info>
2015-01-13 10:51:38 +09:00
Werner Koch
907a9a1e98 gpgsm: Return NULL on fail
* sm/gpgsm.c (parse_keyserver_line): Set SERVER to NULL.

--

Cherry-pick of abd5f6752d693b7f313c19604f0723ecec4d39a6.

Reported-by: Joshua Rogers <git@internot.info>

  "If something inside the ldapserver_parse_one function failed,
   'server' would be freed, then returned, leading to a
   use-after-free.  This code is likely copied from sm/gpgsm.c, which
   was also susceptible to this bug."

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-01-13 10:49:57 +09:00
Werner Koch
d2b0e61313 gpg: Fix possible read of unallocated memory
* g10/parse-packet.c (can_handle_critical): Check content length
before calling can_handle_critical_notation.
--

The problem was found by Jan Bee and gniibe proposed the used fix.
Thanks.

This bug can't be exploited: Only if the announced length of the
notation is 21 or 32 a memcmp against fixed strings using that length
would be done.  The compared data is followed by the actual signature
and thus it is highly likely that not even read of unallocated memory
will happen.  Nevertheless such a bug needs to be fixed.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-01-13 10:44:11 +09:00
Werner Koch
d92fe965f3 scd: Fix possibly inhibited checkpin of the admin pin.
* scd/app-openpgp.c (do_check_pin): Do not check a byte of a released
buffer.

Signed-off-by: Werner Koch <wk@gnupg.org>
2015-01-09 09:07:28 +09:00
Joshua Rogers
40f476867c scd: fix get_public_key for OpenPGPcard v1.0.
* scd/app-openpgp.c (get_public_key): correctly close 'fp' upon use.

--

Inside the get_public_key function, 'fp' was opened using popen, but
incorrectly closed using fclose.

Debian-Bug-Id: 773474
2015-01-08 11:16:51 +09:00
NIIBE Yutaka
4f0d526b7d gpg: release DEK soon after its use.
* g10/keygen.c (generate_subkeypair): Release DEK soon.

--

This fixes the out_of_core error in the test case of adding
RSA-4096 subkey to RSA-4096 primary key with configuration:

    s2k-cipher-algo S10

Debian-bug-id: 772780

Cherry-picked da66ad5bba4215b9ddd0cb927a89aa75355632aa from
STABLE-BRANCH-1-4 branch.
2014-12-12 17:46:45 +09:00
David Prévot
4e03e27575 po: Update French translation 2014-11-26 11:21:52 +01:00
David Prévot
798721f596 po: Update Danish translation 2014-11-26 11:18:00 +01:00
Yuri Chornoivan
e8c3fa7748 po: Update Ukrainian translation 2014-11-26 11:04:49 +01:00
Jedi Lin
445eabf8f7 po: Update Chinese (traditional) translation 2014-11-26 11:02:02 +01:00
Ineiev
d084ae8f53 po: Update Russian translation 2014-11-26 11:00:34 +01:00