[svn] GnuPG - r4400 - branches/STABLE-BRANCH-1-4/g10

[svn author wk]

Author: wk
Date: 2007-01-15 20:30:33 +0100 (Mon, 15 Jan 2007)
New Revision: 4400

Modified:
   branches/STABLE-BRANCH-1-4/g10/ChangeLog
   branches/STABLE-BRANCH-1-4/g10/keygen.c
   branches/STABLE-BRANCH-1-4/g10/parse-packet.c
Log:
	* parse-packet.c (read_protected_v3_mpi): Make sure to stop
	reading even for corrupted packets.
	* keygen.c (generate_user_id): Need to allocate one byte more.
	Reported by Felix von Leitner.


Modified: branches/STABLE-BRANCH-1-4/g10/ChangeLog
===================================================================
--- branches/STABLE-BRANCH-1-4/g10/ChangeLog	2007-01-08 13:35:36 UTC (rev 4399)
+++ branches/STABLE-BRANCH-1-4/g10/ChangeLog	2007-01-15 19:30:33 UTC (rev 4400)
@@ -1,3 +1,10 @@
+2007-01-15  Werner Koch  <wk at g10code.com>
+
+	* parse-packet.c (read_protected_v3_mpi): Make sure to stop
+	reading even for corrupted packets.
+	* keygen.c (generate_user_id): Need to allocate one byte more.
+	Reported by Felix von Leitner.
+
 2006-12-14  David Shaw  <dshaw at jabberwocky.com>
 
 	* options.skel: Tweak some examples to match reality and update

Modified: branches/STABLE-BRANCH-1-4/g10/keygen.c
===================================================================
--- branches/STABLE-BRANCH-1-4/g10/keygen.c	2007-01-08 13:35:36 UTC (rev 4399)
+++ branches/STABLE-BRANCH-1-4/g10/keygen.c	2007-01-15 19:30:33 UTC (rev 4400)
@@ -1958,7 +1958,7 @@
     if( !p )
 	return NULL;
     n = strlen(p);
-    uid = xmalloc_clear( sizeof *uid + n - 1 );
+    uid = xmalloc_clear( sizeof *uid + n );
     uid->len = n;
     strcpy(uid->name, p);
     uid->ref = 1;

Modified: branches/STABLE-BRANCH-1-4/g10/parse-packet.c
===================================================================
--- branches/STABLE-BRANCH-1-4/g10/parse-packet.c	2007-01-08 13:35:36 UTC (rev 4399)
+++ branches/STABLE-BRANCH-1-4/g10/parse-packet.c	2007-01-15 19:30:33 UTC (rev 4400)
@@ -1533,7 +1533,7 @@
   buf = p = xmalloc (2 + nbytes);
   *p++ = nbits >> 8;
   *p++ = nbits;
-  for (; nbytes && length; nbytes--, --*length)
+  for (; nbytes && *length; nbytes--, --*length)
     *p++ = iobuf_get (inp);
   if (nbytes)
     {