security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-22 10:19:57 +01:00
Code Activity
gnupg/common
History
Justus Winter 6823ed4658
gpg,common: Make sure that all fd given are valid. 
* common/sysutils.c (gnupg_fd_valid): New function.
* common/sysutils.h (gnupg_fd_valid): New declaration.
* common/logging.c (log_set_file): Use the new function.
* g10/cpr.c (set_status_fd): Likewise.
* g10/gpg.c (main): Likewise.
* g10/keylist.c (read_sessionkey_from_fd): Likewise.
* g10/passphrase.c (set_attrib_fd): Likewise.
* tests/openpgp/Makefile.am (XTESTS): Add the new test.
* tests/openpgp/issue2941.scm: New file.
--

Consider a situation where the user passes "--status-fd 3" but file
descriptor 3 is not open.

During the course of executing the rest of the commands, it's possible
that gpg itself will open some files, and file descriptor 3 will get
allocated.

In this situation, the status information will be appended directly to
whatever file happens to have landed on fd 3 (the trustdb? the
keyring?).

This is a potential data destruction issue for all writable file
descriptor options:

   --status-fd
   --attribute-fd
   --logger-fd

It's also a potential issue for readable file descriptor options, but
the risk is merely weird behavior, and not data corruption:

   --override-session-key-fd
   --passphrase-fd
   --command-fd

Fixes this by checking whether the fd is valid early on before using
it.

GnuPG-bug-id: 2941
Signed-off-by: Justus Winter <justus@g10code.com>
2017-02-08 14:28:49 +01:00
..
agent-opt.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
argparse.c
Update copyright notices for 2017.
2017-01-23 19:16:55 +01:00
argparse.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
asshelp2.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
asshelp.c
common,w32: Simplify locking.
2016-11-08 16:01:53 +01:00
asshelp.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
audit.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
audit.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
b64dec.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
b64enc.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
call-gpg.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
call-gpg.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
ccparray.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
ccparray.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
ChangeLog-2011
Fix typos
2015-10-28 10:20:17 +01:00
ChangeLog-2011.include
include: Remove this directory.
2014-01-29 17:45:05 +01:00
ChangeLog.jnlib
common: Remove JNLIB from boiler plate (jnlib merge).
2015-04-24 16:42:28 +02:00
common-defs.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
convert.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
dotlock.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
dotlock.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
dynload.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
exaudit.awk
Nuked almost all trailing white space.
2011-02-04 12:57:53 +01:00
exechelp-posix.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
exechelp-w32.c
agent,w32: Fix annoying output to DebugView.
2017-01-06 18:47:53 +01:00
exechelp-w32ce.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
exechelp.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
exectool.c
common: Fix buffer copy code again.
2017-01-19 14:58:23 +01:00
exectool.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
exstatus.awk
Nuked almost all trailing white space.
2011-02-04 12:57:53 +01:00
fwddecl.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
gc-opt-flags.h
gpg: Add option --dirmngr-program.
2014-03-12 18:35:36 +01:00
get-passphrase.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
get-passphrase.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
gettime.c
gpg: Allow to freeze faked system time.
2017-01-19 10:39:06 +01:00
gettime.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
gnupg.ico
w32: Add icons and version information.
2013-05-07 21:35:48 +02:00
gpgrlhelp.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
helpfile.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
homedir.c
common: Support locating components in the build tree.
2016-12-14 16:41:18 +01:00
host2net.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
i18n.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
i18n.h
Fix typos found using codespell.
2015-11-17 12:50:22 +01:00
init.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
init.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
iobuf.c
gpg,sm: Merge the two versions of check_special_filename.
2016-11-29 16:54:36 +01:00
iobuf.h
gpg,sm: Merge the two versions of check_special_filename.
2016-11-29 16:54:36 +01:00
isascii.c
common: Change license of isascii.c to all-premissive,
2015-12-14 16:21:19 +01:00
keyserver.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
localename.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
logging.c
gpg,common: Make sure that all fd given are valid.
2017-02-08 14:28:49 +01:00
logging.h
common: New function log_debug_with_string.
2017-01-11 10:42:44 +01:00
Makefile.am
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
mapstrings.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
mbox-util.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
mbox-util.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
membuf.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
membuf.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
miscellaneous.c
Remove unused debug flags and add "dns" and "network".
2016-12-19 09:41:15 +01:00
mischelp.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
mischelp.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
mkdir_p.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
mkdir_p.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
mkerrors
Nuked almost all trailing white space.
2011-02-04 12:57:53 +01:00
mkerrtok
Nuked almost all trailing white space.
2011-02-04 12:57:53 +01:00
mkstrtable.awk
Nuked almost all trailing white space.
2011-02-04 12:57:53 +01:00
name-value.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
name-value.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
openpgp-oid.c
gpg: New option --default-new-key-algo.
2016-12-02 19:47:40 +01:00
openpgpdefs.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
percent.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
README
common: Update README.
2016-03-02 14:27:30 +01:00
recsel.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
recsel.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
server-help.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
server-help.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
session-env.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
session-env.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
sexp-parse.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
sexputil.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
shareddefs.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
signal.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
simple-pwquery.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
simple-pwquery.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
ssh-utils.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
ssh-utils.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
status.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
status.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
stringhelp.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
stringhelp.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
strlist.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
strlist.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
sysutils.c
gpg,common: Make sure that all fd given are valid.
2017-02-08 14:28:49 +01:00
sysutils.h
gpg,common: Make sure that all fd given are valid.
2017-02-08 14:28:49 +01:00
t-b64.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-ccparray.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-convert.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-dotlock.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-exechelp.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-exectool.c
tests: Avoid skipping exectool tests.
2016-12-20 18:39:30 +01:00
t-gettime.c
tests: Fix t-gettime for a time_t of 64 and a long of 32 bit.
2017-01-12 10:39:19 +01:00
t-helpfile.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-iobuf.c
Replace use of variable-length-arrays.
2017-01-02 13:29:18 +01:00
t-mapstrings.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-mbox-util.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-name-value.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-openpgp-oid.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-percent.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-recsel.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-session-env.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-sexputil.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-ssh-utils.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-stringhelp.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-strlist.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-support.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-support.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-sysutils.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-timestuff.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-w32-reg.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
t-zb32.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
tlv.c
Silence two -Wlogical-op warnings.
2017-01-05 20:43:40 +01:00
tlv.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
ttyio.c
common: Remove unused function tty_print_string.
2017-01-17 10:19:06 +01:00
ttyio.h
common: Remove unused function tty_print_string.
2017-01-17 10:19:06 +01:00
types.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
userids.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
userids.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
utf8conv.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
utf8conv.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
util.h
common: Support locating components in the build tree.
2016-12-14 16:41:18 +01:00
utilproto.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
w32-reg.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
w32help.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
w32info-rc.h.in
Update copyright notices for 2017.
2017-01-23 19:16:55 +01:00
xasprintf.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
xreadline.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
yesno.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
zb32.c
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00
zb32.h
Change all http://www.gnu.org in license notices to https://
2016-11-05 12:02:19 +01:00

README 

Common functionality used by all modules of GnuPG.