segfault in gpg --list-options show-photos --list-secret-keys

[Daniel Kahn Gillmor]

hi folks--

it looks like if there is a User Attribute (UAT, i.e. an attached photo)
in the secret keyring, then the following command raises a segmentation
fault:

  gpg --list-options show-photos --list-secret-keys

Here is a backtrace:

> #0  keyid_from_pk (pk=0x0, keyid=0xbffff658) at ../../g10/keyid.c:320
> #1  0x080b0ca7 in get_validity (pk=0x0, uid=0x812c760) at ../../g10/trustdb.c:1085
> #2  0x080b0f88 in get_validity_info (pk=0x0, uid=0x812c760) at ../../g10/trustdb.c:1185
> #3  0x080c14aa in show_photos (attrs=0x812c750, count=1, pk=0x0, sk=0x812c238, uid=0x812c760) at ../../g10/photoid.c:307
> #4  0x0807598f in list_keyblock_print (keyblock=0x812c510, secret=<value optimized out>, fpr=<value optimized out>, opaque=0x0) at ../../g10/keylist.c:857
> #5  0x08075f76 in list_keyblock (keyblock=0x812c510, secret=1, fpr=0, opaque=0x0) at ../../g10/keylist.c:1457
> #6  0x08077648 in list_all (secret=<value optimized out>) at ../../g10/keylist.c:445
> #7  0x08052c8d in main (argc=0, argv=0xbffffc94) at ../../g10/gpg.c:3593

the attached tarball provides a simple gpg home directory with such a
setup.  To replicate the crash, do:

 tar xzf test-keyring-20100304.tgz
 export GNUPGHOME=test-keyring-20100304
 gpg --list-options show-photos --list-secret-keys

i looked at doing a simple workaround (e.g. making keyid_from_pk()
return 0xffffffff when pk is NULL), but more attempts to dereference pk
happen after keyid_from_pk anyway, so i don't think that was the right
track.

	--dkg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: test-keyring-20100304.tgz
Type: application/x-compressed-tar
Size: 3236 bytes
Desc: not available
URL: </pipermail/attachments/20100304/4f50e45b/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 891 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20100304/4f50e45b/attachment-0001.pgp>