Key import segfault in libgcrypt

[Daniel Kahn Gillmor]

On 04/02/2014 04:41 AM, Hanno Böck wrote:

> On my system if I try to import this key
> http://pgp.mit.edu/pks/lookup?op=get&search=0x98EEB6F7D87171CF
> with gnupg it segfaults.
> 
> Backtrace (see below) indicates that the crash happens somewhere in
> libgcrypt, so I'm posting it here.
> 
> My libgcrypt version is 1.6.1, gnupg is 2.0.22.

I can reproduce with packages from debian, gnupg2 v2.0.22-3 and
libgcrypt11 v1.5.3.

backtrace:


Program received signal SIGSEGV, Segmentation fault.
_gcry_mpi_get_flag (a=a at entry=0x0, flag=flag at entry=GCRYMPI_FLAG_OPAQUE)
    at mpiutil.c:455
455	mpiutil.c: No such file or directory.
(gdb) bt
#0  _gcry_mpi_get_flag (a=a at entry=0x0, flag=flag at entry=GCRYMPI_FLAG_OPAQUE)
    at mpiutil.c:455
#1  0x00007ffff72e1448 in vsexp_sscan
(retsexp=retsexp at entry=0x7fffffffddb8,
    erroff=0x7fffffffdbd0, erroff at entry=0x0,
    buffer=buffer at entry=0x5555555e602a "(public-key(rsa(n%m)(e%m)))",
    length=<optimized out>, argflag=argflag at entry=1,
    arg_list=arg_list at entry=0x0, arg_ptr=arg_ptr at entry=0x7fffffffdcb8)
    at sexp.c:1273
#2  0x00007ffff72e289c in _gcry_sexp_vbuild (retsexp=0x7fffffffddb8,
    erroff=0x0, format=0x5555555e602a "(public-key(rsa(n%m)(e%m)))",
    arg_ptr=arg_ptr at entry=0x7fffffffdcb8) at sexp.c:1620
#3  0x00007ffff72dd212 in gcry_sexp_build (retsexp=<optimized out>,
    erroff=<optimized out>, format=<optimized out>) at visibility.c:115
#4  0x000055555558f0bf in ?? ()


	--dkg

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 1010 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20140407/6752635a/attachment.sig>