Gnupg cannot handle extremely large keys on 32 bit Linux
gpglist at umbra-obscura.de
Mon Apr 16 18:54:29 CEST 2007
Am Montag 16 April 2007 schrieb Werner Koch:
> I think I found the problem: In g10/gpg.h you find
> /* Number of bits we accept when reading or writing MPIs. */
> #define MAX_EXTERN_MPI_BITS 16384
> when writing it out with build-packet.c:mpi_write, we use a buffer if
> that length. It should error out for too long values but there might be
> a corner case. To check whether it works, change that constant to a
> larger or smaller value and watch what results.
--- gnupg-2.0.3/g10/build-packet.c 2006-10-18 15:50:43.000000000 +0200
+++ gnupg-2.0.3-fixed/g10/build-packet.c 2007-04-16 18:40:31.000000000
@@ -157,7 +157,7 @@
mpi_write (iobuf_t out, gcry_mpi_t a)
- char buffer[(MAX_EXTERN_MPI_BITS+7)/8];
+ char buffer[(MAX_EXTERN_MPI_BITS+7)/8+2];
Seems like this fixes the problem. mpi_write allocates 2 bytes less it should.
It shouldn't be security relevant on usual architectures, but it is a bug for
The last MPI bytes of the MPI seem to be 0802, which is the content of int rc.
On Mac you probably get 0000 because the endian is different
More information about the Gnupg-users