[git] GnuPG - branch, master, updated. gnupg-2.1.0beta3-431-g958e5f2

by Werner Koch cvs at cvs.gnupg.org
Mon Jun 2 19:52:36 CEST 2014


This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  958e5f292fa3f8e127f54bc088c56780c564dcae (commit)
       via  f3249b1c4d0f2e9e0e8956042677e47fc9c6f6c0 (commit)
       via  d9cde7ba7d4556b216f062d0cf92d60cbb204b00 (commit)
      from  715285bcbc12c024dbd9b633805189c09173e317 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 958e5f292fa3f8e127f54bc088c56780c564dcae
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jun 2 19:51:23 2014 +0200

    gpg: Avoid NULL-deref in default key listing.
    
    * g10/keyid.c (hash_public_key): Take care of NULL keys.
    * g10/misc.c (pubkey_nbits): Ditto.
    --
    
    This problem was mainly due to our ECC code while checking for opaque
    MPIs with the curve name.

diff --git a/g10/keyid.c b/g10/keyid.c
index 2883af1..9c94bd6 100644
--- a/g10/keyid.c
+++ b/g10/keyid.c
@@ -167,7 +167,15 @@ hash_public_key (gcry_md_hd_t md, PKT_public_key *pk)
     {
       for (i=0; i < npkey; i++ )
         {
-          if (gcry_mpi_get_flag (pk->pkey[i], GCRYMPI_FLAG_OPAQUE))
+          if (!pk->pkey[i])
+            {
+              /* This case may only happen if the parsing of the MPI
+                 failed but the key was anyway created.  May happen
+                 during "gpg KEYFILE".  */
+              pp[i] = NULL;
+              nn[i] = 0;
+            }
+          else if (gcry_mpi_get_flag (pk->pkey[i], GCRYMPI_FLAG_OPAQUE))
             {
               const void *p;
 
diff --git a/g10/misc.c b/g10/misc.c
index 54ddad2..e219d76 100644
--- a/g10/misc.c
+++ b/g10/misc.c
@@ -1628,46 +1628,54 @@ pubkey_get_nenc (pubkey_algo_t algo)
 unsigned int
 pubkey_nbits( int algo, gcry_mpi_t *key )
 {
-    int rc, nbits;
-    gcry_sexp_t sexp;
+  int rc, nbits;
+  gcry_sexp_t sexp;
 
-    if( algo == PUBKEY_ALGO_DSA ) {
-	rc = gcry_sexp_build ( &sexp, NULL,
-			      "(public-key(dsa(p%m)(q%m)(g%m)(y%m)))",
-				  key[0], key[1], key[2], key[3] );
+  if (algo == PUBKEY_ALGO_DSA
+      && key[0] && key[1] && key[2] && key[3])
+    {
+      rc = gcry_sexp_build (&sexp, NULL,
+                            "(public-key(dsa(p%m)(q%m)(g%m)(y%m)))",
+                            key[0], key[1], key[2], key[3] );
     }
-    else if( algo == PUBKEY_ALGO_ELGAMAL || algo == PUBKEY_ALGO_ELGAMAL_E ) {
-	rc = gcry_sexp_build ( &sexp, NULL,
-			      "(public-key(elg(p%m)(g%m)(y%m)))",
-				  key[0], key[1], key[2] );
+  else if ((algo == PUBKEY_ALGO_ELGAMAL || algo == PUBKEY_ALGO_ELGAMAL_E)
+           && key[0] && key[1] && key[2])
+    {
+      rc = gcry_sexp_build (&sexp, NULL,
+                            "(public-key(elg(p%m)(g%m)(y%m)))",
+                            key[0], key[1], key[2] );
     }
-    else if( is_RSA (algo) ) {
-	rc = gcry_sexp_build ( &sexp, NULL,
-			      "(public-key(rsa(n%m)(e%m)))",
-				  key[0], key[1] );
+  else if (is_RSA (algo)
+           && key[0] && key[1])
+    {
+      rc = gcry_sexp_build (&sexp, NULL,
+                            "(public-key(rsa(n%m)(e%m)))",
+                            key[0], key[1] );
     }
-    else if (algo == PUBKEY_ALGO_ECDSA || algo == PUBKEY_ALGO_ECDH
-             || algo == PUBKEY_ALGO_EDDSA) {
-        char *curve = openpgp_oid_to_str (key[0]);
-        if (!curve)
-          rc = gpg_error_from_syserror ();
-        else
-          {
-            rc = gcry_sexp_build (&sexp, NULL,
-                                  "(public-key(ecc(curve%s)(q%m)))",
-				  curve, key[1]);
-            xfree (curve);
-          }
+  else if ((algo == PUBKEY_ALGO_ECDSA || algo == PUBKEY_ALGO_ECDH
+            || algo == PUBKEY_ALGO_EDDSA)
+           && key[0] && key[1])
+    {
+      char *curve = openpgp_oid_to_str (key[0]);
+      if (!curve)
+        rc = gpg_error_from_syserror ();
+      else
+        {
+          rc = gcry_sexp_build (&sexp, NULL,
+                                "(public-key(ecc(curve%s)(q%m)))",
+                                curve, key[1]);
+          xfree (curve);
+        }
     }
-    else
-	return 0;
+  else
+    return 0;
 
-    if ( rc )
-	BUG ();
+  if (rc)
+    BUG ();
 
-    nbits = gcry_pk_get_nbits( sexp );
-    gcry_sexp_release( sexp );
-    return nbits;
+  nbits = gcry_pk_get_nbits (sexp);
+  gcry_sexp_release (sexp);
+  return nbits;
 }
 
 

commit f3249b1c4d0f2e9e0e8956042677e47fc9c6f6c0
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jun 2 19:50:18 2014 +0200

    gpg: Simplify default key listing.
    
    * g10/mainproc.c (list_node): Rework.
    --
    
    GnuPG-bug-id: 1640

diff --git a/g10/mainproc.c b/g10/mainproc.c
index 28bb05e..890c0a4 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -921,267 +921,203 @@ print_userid( PACKET *pkt )
 static void
 list_node( CTX c, KBNODE node )
 {
-    int any=0;
-    int mainkey;
-    char pkstrbuf[PUBKEY_STRING_SIZE];
+  int mainkey;
+  char pkstrbuf[PUBKEY_STRING_SIZE];
 
-    if( !node )
-	;
-    else if( (mainkey = (node->pkt->pkttype == PKT_PUBLIC_KEY) )
-	     || node->pkt->pkttype == PKT_PUBLIC_SUBKEY ) {
-	PKT_public_key *pk = node->pkt->pkt.public_key;
+  if (!node)
+    ;
+  else if ((mainkey = (node->pkt->pkttype == PKT_PUBLIC_KEY))
+           || node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
+    {
+      PKT_public_key *pk = node->pkt->pkt.public_key;
 
-	if( opt.with_colons )
-	  {
-	    u32 keyid[2];
-	    keyid_from_pk( pk, keyid );
-	    if( mainkey )
-	      c->trustletter = opt.fast_list_mode?
-		0 : get_validity_info( pk, NULL );
-	    printf("%s:", mainkey? "pub":"sub" );
-	    if( c->trustletter )
-	      putchar( c->trustletter );
-	    printf(":%u:%d:%08lX%08lX:%s:%s::",
-		   nbits_from_pk( pk ),
-		   pk->pubkey_algo,
-		   (ulong)keyid[0],(ulong)keyid[1],
-		   colon_datestr_from_pk( pk ),
-		   colon_strtime (pk->expiredate) );
-	    if( mainkey && !opt.fast_list_mode )
-	      putchar( get_ownertrust_info (pk) );
-	    putchar(':');
-	    if( node->next && node->next->pkt->pkttype == PKT_RING_TRUST) {
-	      putchar('\n'); any=1;
-	      if( opt.fingerprint )
-		print_fingerprint (NULL, pk, 0);
-	      printf("rtv:1:%u:\n",
-		     node->next->pkt->pkt.ring_trust->trustval );
-	    }
-	  }
-	else
-	  printf("%s  %s/%s %s%s",
-		 mainkey? "pub":"sub",
-                 pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
-		 keystr_from_pk( pk ),
-		 datestr_from_pk( pk ), mainkey?" ":"");
-
-	if( mainkey ) {
-	    /* and now list all userids with their signatures */
-	    for( node = node->next; node; node = node->next ) {
-		if( node->pkt->pkttype == PKT_SIGNATURE ) {
-		    if( !any ) {
-			if( node->pkt->pkt.signature->sig_class == 0x20 )
-			    puts("[revoked]");
-			else
-			    putchar('\n');
-			any = 1;
-		    }
-		    list_node(c,  node );
-		}
-		else if( node->pkt->pkttype == PKT_USER_ID ) {
-		    if( any ) {
-			if( opt.with_colons )
-			    printf("%s:::::::::",
-			      node->pkt->pkt.user_id->attrib_data?"uat":"uid");
-			else
-			    printf( "uid%*s", 28, "" );
-		    }
-		    print_userid( node->pkt );
-		    if( opt.with_colons )
-			putchar(':');
-		    putchar('\n');
-		    if( opt.fingerprint && !any )
-                        print_fingerprint (NULL, pk, 0 );
-		    if( opt.with_colons
-                        && node->next
-			&& node->next->pkt->pkttype == PKT_RING_TRUST ) {
-			printf("rtv:2:%u:\n",
-                               node->next->pkt->pkt.ring_trust?
-                               node->next->pkt->pkt.ring_trust->trustval : 0);
-		    }
-		    any=1;
-		}
-		else if( node->pkt->pkttype == PKT_PUBLIC_SUBKEY ) {
-		    if( !any ) {
-			putchar('\n');
-			any = 1;
-		    }
-		    list_node(c,  node );
-		}
-	    }
-	}
-	else
-	  {
-	    /* of subkey */
-	    if( pk->flags.revoked )
-	      {
-		printf(" [");
-		printf(_("revoked: %s"),revokestr_from_pk(pk));
-		printf("]");
-	      }
-	    else if( pk->expiredate )
-	      {
-		printf(" [");
-		printf(_("expires: %s"),expirestr_from_pk(pk));
-		printf("]");
-	      }
-	  }
+      if (opt.with_colons)
+        {
+          u32 keyid[2];
+
+          keyid_from_pk( pk, keyid );
+          if (mainkey)
+            c->trustletter = (opt.fast_list_mode?
+                              0 : get_validity_info( pk, NULL));
+          es_printf ("%s:", mainkey? "pub":"sub" );
+          if (c->trustletter)
+            es_putc (c->trustletter, es_stdout);
+          es_printf (":%u:%d:%08lX%08lX:%s:%s::",
+                     nbits_from_pk( pk ),
+                     pk->pubkey_algo,
+                     (ulong)keyid[0],(ulong)keyid[1],
+                     colon_datestr_from_pk( pk ),
+                     colon_strtime (pk->expiredate) );
+          if (mainkey && !opt.fast_list_mode)
+            es_putc (get_ownertrust_info (pk), es_stdout);
+          es_putc (':', es_stdout);
+        }
+      else
+        es_printf ("%s  %s/%s %s",
+                   mainkey? "pub":"sub",
+                   pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
+                   keystr_from_pk (pk),
+                   datestr_from_pk (pk));
 
-	if( !any )
-	    putchar('\n');
-	if( !mainkey && opt.fingerprint > 1 )
-            print_fingerprint (NULL, pk, 0);
+      if (pk->flags.revoked)
+        {
+          es_printf (" [");
+          es_printf (_("revoked: %s"), revokestr_from_pk (pk));
+          es_printf ("]\n");
+        }
+      else if( pk->expiredate && !opt.with_colons)
+        {
+          es_printf (" [");
+          es_printf (_("expires: %s"), expirestr_from_pk (pk));
+          es_printf ("]\n");
+        }
+      else
+        es_putc ('\n', es_stdout);
+
+      if ((mainkey && opt.fingerprint) || opt.fingerprint > 1)
+        print_fingerprint (NULL, pk, 0);
+
+      if (opt.with_colons)
+        {
+          if (node->next && node->next->pkt->pkttype == PKT_RING_TRUST)
+            es_printf ("rtv:1:%u:\n",
+                       node->next->pkt->pkt.ring_trust->trustval);
+        }
+
+      if (mainkey)
+        {
+          /* Now list all userids with their signatures. */
+          for (node = node->next; node; node = node->next)
+            {
+              if (node->pkt->pkttype == PKT_SIGNATURE)
+                {
+                  list_node (c,  node );
+                }
+              else if (node->pkt->pkttype == PKT_USER_ID)
+                {
+                  if (opt.with_colons)
+                    es_printf ("%s:::::::::",
+                               node->pkt->pkt.user_id->attrib_data?"uat":"uid");
+                  else
+                    es_printf ("uid%*s", 28, "" );
+                  print_userid (node->pkt);
+                  if (opt.with_colons)
+                    es_putc (':', es_stdout);
+                  es_putc ('\n', es_stdout);
+                  if (opt.with_colons
+                      && node->next
+                      && node->next->pkt->pkttype == PKT_RING_TRUST)
+                    {
+                      es_printf ("rtv:2:%u:\n",
+                                 node->next->pkt->pkt.ring_trust?
+                                 node->next->pkt->pkt.ring_trust->trustval : 0);
+                    }
+		}
+              else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
+                {
+                  list_node(c,  node );
+                }
+            }
+        }
     }
-    else if( (mainkey = (node->pkt->pkttype == PKT_SECRET_KEY) )
-	     || node->pkt->pkttype == PKT_SECRET_SUBKEY ) {
+  else if ((mainkey = (node->pkt->pkttype == PKT_SECRET_KEY) )
+           || node->pkt->pkttype == PKT_SECRET_SUBKEY)
+    {
 
       log_debug ("FIXME: No way to print secret key packets here\n");
-      /* fixme: We may use a fucntion to trun a secret key packet into
+      /* fixme: We may use a fucntion to turn a secret key packet into
          a public key one and use that here.  */
-	/* PKT_secret_key *sk = node->pkt->pkt.secret_key; */
-
-	/* if( opt.with_colons ) */
-	/*   { */
-	/*     u32 keyid[2]; */
-	/*     keyid_from_sk( sk, keyid ); */
-	/*     printf("%s::%u:%d:%08lX%08lX:%s:%s:::", */
-	/* 	   mainkey? "sec":"ssb", */
-	/* 	   nbits_from_sk( sk ), */
-	/* 	   sk->pubkey_algo, */
-	/* 	   (ulong)keyid[0],(ulong)keyid[1], */
-	/* 	   colon_datestr_from_sk( sk ), */
-	/* 	   colon_strtime (sk->expiredate) */
-	/* 	   /\* fixme: add LID *\/ ); */
-	/*   } */
-	/* else */
-	/*   printf("%s  %4u%c/%s %s ", mainkey? "sec":"ssb", */
-	/* 	 nbits_from_sk( sk ), pubkey_letter( sk->pubkey_algo ), */
-	/* 	 keystr_from_sk( sk ), datestr_from_sk( sk )); */
-	/* if( mainkey ) { */
-	/*     /\* and now list all userids with their signatures *\/ */
-	/*     for( node = node->next; node; node = node->next ) { */
-	/* 	if( node->pkt->pkttype == PKT_SIGNATURE ) { */
-	/* 	    if( !any ) { */
-	/* 		if( node->pkt->pkt.signature->sig_class == 0x20 ) */
-	/* 		    puts("[revoked]"); */
-	/* 		else */
-	/* 		    putchar('\n'); */
-	/* 		any = 1; */
-	/* 	    } */
-	/* 	    list_node(c,  node ); */
-	/* 	} */
-	/* 	else if( node->pkt->pkttype == PKT_USER_ID ) { */
-	/* 	    if( any ) { */
-	/* 		if( opt.with_colons ) */
-	/* 		    printf("%s:::::::::", */
-	/* 		      node->pkt->pkt.user_id->attrib_data?"uat":"uid"); */
-	/* 		else */
-	/* 		    printf( "uid%*s", 28, "" ); */
-	/* 	    } */
-	/* 	    print_userid( node->pkt ); */
-	/* 	    if( opt.with_colons ) */
-	/* 		putchar(':'); */
-	/* 	    putchar('\n'); */
-	/* 	    if( opt.fingerprint && !any ) */
-	/* 		print_fingerprint( NULL, sk, 0 ); */
-	/* 	    any=1; */
-	/* 	} */
-	/* 	else if( node->pkt->pkttype == PKT_SECRET_SUBKEY ) { */
-	/* 	    if( !any ) { */
-	/* 		putchar('\n'); */
-	/* 		any = 1; */
-	/* 	    } */
-	/* 	    list_node(c,  node ); */
-	/* 	} */
-	/*     } */
-	/* } */
-	/* if( !any ) */
-	/*     putchar('\n'); */
-	/* if( !mainkey && opt.fingerprint > 1 ) */
-	/*     print_fingerprint( NULL, sk, 0 ); */
     }
-    else if( node->pkt->pkttype == PKT_SIGNATURE  ) {
-	PKT_signature *sig = node->pkt->pkt.signature;
-	int is_selfsig = 0;
-	int rc2=0;
-	size_t n;
-	char *p;
-	int sigrc = ' ';
+  else if (node->pkt->pkttype == PKT_SIGNATURE)
+    {
+      PKT_signature *sig = node->pkt->pkt.signature;
+      int is_selfsig = 0;
+      int rc2 = 0;
+      size_t n;
+      char *p;
+      int sigrc = ' ';
 
-	if( !opt.verbose )
-	    return;
+      if (!opt.verbose)
+        return;
 
-	if( sig->sig_class == 0x20 || sig->sig_class == 0x30 )
-	    fputs("rev", stdout);
-	else
-	    fputs("sig", stdout);
-	if( opt.check_sigs ) {
-	    fflush(stdout);
-	    rc2=do_check_sig( c, node, &is_selfsig, NULL, NULL );
-	    switch (gpg_err_code (rc2)) {
-	      case 0:		             sigrc = '!'; break;
-	      case GPG_ERR_BAD_SIGNATURE:    sigrc = '-'; break;
-	      case GPG_ERR_NO_PUBKEY:
-	      case GPG_ERR_UNUSABLE_PUBKEY:  sigrc = '?'; break;
-	      default:		             sigrc = '%'; break;
+      if (sig->sig_class == 0x20 || sig->sig_class == 0x30)
+        es_fputs ("rev", es_stdout);
+      else
+        es_fputs ("sig", es_stdout);
+      if (opt.check_sigs)
+        {
+          fflush (stdout);
+          rc2 = do_check_sig (c, node, &is_selfsig, NULL, NULL);
+          switch (gpg_err_code (rc2))
+            {
+            case 0:		          sigrc = '!'; break;
+            case GPG_ERR_BAD_SIGNATURE:   sigrc = '-'; break;
+            case GPG_ERR_NO_PUBKEY:
+            case GPG_ERR_UNUSABLE_PUBKEY: sigrc = '?'; break;
+            default:		          sigrc = '%'; break;
 	    }
 	}
-	else {	/* check whether this is a self signature */
-	    u32 keyid[2];
+      else /* Check whether this is a self signature.  */
+        {
+          u32 keyid[2];
 
-	    if( c->list->pkt->pkttype == PKT_PUBLIC_KEY
-		|| c->list->pkt->pkttype == PKT_SECRET_KEY )
-              {
-                keyid_from_pk (c->list->pkt->pkt.public_key, keyid);
+          if (c->list->pkt->pkttype == PKT_PUBLIC_KEY
+              || c->list->pkt->pkttype == PKT_SECRET_KEY )
+            {
+              keyid_from_pk (c->list->pkt->pkt.public_key, keyid);
 
-                if( keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1] )
-                  is_selfsig = 1;
-              }
+              if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1])
+                is_selfsig = 1;
+            }
 	}
-	if( opt.with_colons ) {
-	    putchar(':');
-	    if( sigrc != ' ' )
-		putchar(sigrc);
-	    printf("::%d:%08lX%08lX:%s:%s:", sig->pubkey_algo,
-		   (ulong)sig->keyid[0], (ulong)sig->keyid[1],
-		   colon_datestr_from_sig(sig),
-		   colon_expirestr_from_sig(sig));
-
-	    if(sig->trust_depth || sig->trust_value)
-	      printf("%d %d",sig->trust_depth,sig->trust_value);
-	    printf(":");
-
-	    if(sig->trust_regexp)
-	      es_write_sanitized (es_stdout,sig->trust_regexp,
-                                  strlen(sig->trust_regexp), ":", NULL);
-	    printf(":");
+
+      if (opt.with_colons)
+        {
+          es_putc (':', es_stdout);
+          if (sigrc != ' ')
+            es_putc (sigrc, es_stdout);
+          es_printf ("::%d:%08lX%08lX:%s:%s:", sig->pubkey_algo,
+                     (ulong)sig->keyid[0], (ulong)sig->keyid[1],
+                     colon_datestr_from_sig (sig),
+                     colon_expirestr_from_sig (sig));
+
+          if (sig->trust_depth || sig->trust_value)
+            es_printf ("%d %d",sig->trust_depth,sig->trust_value);
+          es_putc (':', es_stdout);
+
+          if (sig->trust_regexp)
+            es_write_sanitized (es_stdout, sig->trust_regexp,
+                                strlen (sig->trust_regexp), ":", NULL);
+          es_putc (':', es_stdout);
 	}
-	else
-	  printf("%c       %s %s   ",
-		 sigrc, keystr(sig->keyid), datestr_from_sig(sig));
-	if( sigrc == '%' )
-	    printf("[%s] ", g10_errstr(rc2) );
-	else if( sigrc == '?' )
-	    ;
-	else if( is_selfsig ) {
-	    if( opt.with_colons )
-		putchar(':');
-	    fputs( sig->sig_class == 0x18? "[keybind]":"[selfsig]", stdout);
-	    if( opt.with_colons )
-		putchar(':');
+      else
+        es_printf ("%c       %s %s   ",
+                   sigrc, keystr (sig->keyid), datestr_from_sig(sig));
+      if (sigrc == '%')
+        es_printf ("[%s] ", g10_errstr(rc2) );
+      else if (sigrc == '?')
+        ;
+      else if (is_selfsig)
+        {
+          if (opt.with_colons)
+            es_putc (':', es_stdout);
+          es_fputs (sig->sig_class == 0x18? "[keybind]":"[selfsig]", es_stdout);
+          if (opt.with_colons)
+            es_putc (':', es_stdout);
 	}
-	else if( !opt.fast_list_mode ) {
-	    p = get_user_id( sig->keyid, &n );
-	    es_write_sanitized (es_stdout, p, n,
-                                opt.with_colons?":":NULL, NULL );
-	    xfree(p);
+      else if (!opt.fast_list_mode)
+        {
+          p = get_user_id (sig->keyid, &n);
+          es_write_sanitized (es_stdout, p, n,
+                              opt.with_colons?":":NULL, NULL );
+          xfree (p);
 	}
-	if( opt.with_colons )
-	    printf(":%02x%c:", sig->sig_class, sig->flags.exportable?'x':'l');
-	putchar('\n');
+      if (opt.with_colons)
+        es_printf (":%02x%c:", sig->sig_class, sig->flags.exportable?'x':'l');
+      es_putc ('\n', es_stdout);
     }
-    else
-	log_error("invalid node with packet of type %d\n", node->pkt->pkttype);
+  else
+    log_error ("invalid node with packet of type %d\n", node->pkt->pkttype);
 }
 
 

commit d9cde7ba7d4556b216f062d0cf92d60cbb204b00
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jun 2 18:38:04 2014 +0200

    gpg: Graceful skip reading of corrupt MPIs.
    
    * g10/parse-packet.c (mpi_read): Change error message on overflow.
    --
    
    This gets gpg 2.x in sync to what gpg 1.4 does.  No need to die for a
    broken MPI.
    
    GnuPG-bug-id: 1593
    
    Resolved conflicts:
    	g10/parse-packet.c - whitespaces fixes.

diff --git a/g10/parse-packet.c b/g10/parse-packet.c
index 424b052..26ca038 100644
--- a/g10/parse-packet.c
+++ b/g10/parse-packet.c
@@ -107,27 +107,32 @@ read_32 (IOBUF inp)
 static gcry_mpi_t
 mpi_read (iobuf_t inp, unsigned int *ret_nread, int secure)
 {
-  /*FIXME: Needs to be synced with gnupg14/mpi/mpicoder.c */
-
   int c, c1, c2, i;
+  unsigned int nmax = *ret_nread;
   unsigned int nbits, nbytes;
   size_t nread = 0;
   gcry_mpi_t a = NULL;
   byte *buf = NULL;
   byte *p;
 
+  if (!nmax)
+    goto overflow;
+
   if ((c = c1 = iobuf_get (inp)) == -1)
     goto leave;
+  if (++nread == nmax)
+    goto overflow;
   nbits = c << 8;
   if ((c = c2 = iobuf_get (inp)) == -1)
     goto leave;
+  ++nread;
   nbits |= c;
   if (nbits > MAX_EXTERN_MPI_BITS)
     {
       log_error ("mpi too large (%u bits)\n", nbits);
       goto leave;
     }
-  nread = 2;
+
   nbytes = (nbits + 7) / 8;
   buf = secure ? gcry_xmalloc_secure (nbytes + 2) : gcry_xmalloc (nbytes + 2);
   p = buf;
@@ -136,18 +141,23 @@ mpi_read (iobuf_t inp, unsigned int *ret_nread, int secure)
   for (i = 0; i < nbytes; i++)
     {
       p[i + 2] = iobuf_get (inp) & 0xff;
+      if (nread == nmax)
+        goto overflow;
       nread++;
     }
 
   if (gcry_mpi_scan (&a, GCRYMPI_FMT_PGP, buf, nread, &nread))
     a = NULL;
 
+  *ret_nread = nread;
+  gcry_free(buf);
+  return a;
+
+ overflow:
+  log_error ("mpi larger than indicated length (%u bits)\n", 8*nmax);
  leave:
-  gcry_free (buf);
-  if (nread > *ret_nread)
-    log_bug ("mpi larger than packet (%zu/%u)", nread, *ret_nread);
-  else
-    *ret_nread = nread;
+  *ret_nread = nread;
+  gcry_free(buf);
   return a;
 }
 

-----------------------------------------------------------------------

Summary of changes:
 g10/keyid.c        |   10 +-
 g10/mainproc.c     |  420 ++++++++++++++++++++++------------------------------
 g10/misc.c         |   74 ++++-----
 g10/parse-packet.c |   26 +++-
 4 files changed, 246 insertions(+), 284 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org




More information about the Gnupg-commits mailing list