problems importing signature/compilation patch

[Nick Rasmussen]

A friend signed my public key with a dss key using pgp-5.0, and gpg (1.0.2)
seems to have problems reading in the signed key.  importing it into pgp-5.0
and pgp-6.5.1 works fine.

Here's what the import does:

> gpg --import signedpub.asc
gpg: Warning: using insecure memory!
gpg: mpi too large (54458 bits)

gpg: Ohhhh jeeee: mpi crosses packet bordersecmem usage: 0/0 bytes in 0/0 blocks of pool 0/16384
Abort


Here is the signed key that is triggering the bug:


-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGPfreeware 5.0i for non-commercial use

mQGiBDlyfhsRBAC9YU0waOpTgcea/9PGreTImRhny/8O3Q09s4R2IbWWkHd85NZ2
4VJA6DQUAzFLPXeUavKZwT5Bpw4XmMWi1BRFO7a35Zh2bP0Vp8mF9550APCimlZ3
GIDhcxMrUu0E1DIkgV8P3gDn1+TmuWPKohuEAa6hQU856HOzPC0BrHyQawCgu0YO
yHkc7IIzfj0dJzOCmZXy56sEAJXycT5jtfyqAwSVGQAxb0JElNIKsPnUCJp444h6
bcZRNpJvbY/yJI7od5k7B9EMGOlM7FmVTvw/++O5wakgFaqmwSsWkl7+r5Vcmw6a
ujsKi9rlATkKPqUOWPWuyoHy5hHCyiPb16iJ9hRFQYjwczxIIuwrXojmMwplyDj5
y4szA/sF7saps7FWy9qx981SY9t4cOCi3xDcYs5ejZQimYpx+ePjCRS+xE0/4Fnx
j4mwiFKAAzlyGRzX22bFRGVrpeO3DpZ7gjw0cI6h/Pe8tJNqnTOcqvkJ+ASTBt7+
CfemQ/5pfQ2+AwE9SvwqWXAgnpk5t5OeRDDv5msvg2m9cn5fQbQeTmljayBSYXNt
dXNzZW4gPG5pY2tAaml2ZS5vcmc+iQBWBBMRAgAWBQI5cn4bBAsKBAMDFQMCAxYC
AQIXgAAKCRBh8l3CiffjNRgFAJ4yL9izU5paM+fOYCcg+ucPZejEogCfTiOPGuPj
BtyH+i+KWmIpyIz9LC2JAEYEEBECAAYFAjlznDkACgkQbfhFzUXViSBOwgCeOp3i
v5HBqm1SvpfPOr9AoZ7w4XUAn1+y0HSpcwfLp9fxX46bzk/TDG1hiQA/AwUQOX0B
syX+PaaciNhNEQJkKgCdE6Emz3+oB9WalPlPiqlBrwgPteYAn0gYUl1yrVM1VRQ2
PCepWDFOvcCluQENBDlyfiYQBACK+GqcGbQnt02KWSyR80RuRbnrLB/KuOmTlOB+
Q+bMknvmqmM4VPpirBn9o7fymppkRbCagTb+LrefDHVZtTBgSa6y6/+9PObUEtYN
11PqzwADBQP/XM/g327E1b8C4u/q5LGAETF9B3Xr24gA9aXCn3RzBYh/1evmx2ma
xc+7n9S6DQMLHCcxDRCZhAZbp2FXX5jMME34ZHgB30ldkqJqBPUrXrVq4halTnnz
LK1+6dB/A+h+idp244Mkq95u4ixWQqKH2fcrw4YJIufhIK3lS2xjbDmIRgQYEQIA
BgUCOXJ+JgAKCRBh8l3CiffjNWTJAJ46oVvmkum3wteel4X+lzZzt/Y=
=RzXE
-----END PGP PUBLIC KEY BLOCK-----


Just out of curiosity, I recompiled gpg (1.0.2) with --enable-m-debug and
--enable-m-guard, and it did not link.  After making the small fix needed,
the behaviour was still the same.

Any ideas as to what is wrong?

thanks
-nick

The changes that I make to get it compile were:

diff -ru gnupg-1.0.2/mpi/mpiutil.c gnupg-1.0.2-memfix/mpi/mpiutil.c
--- gnupg-1.0.2/mpi/mpiutil.c	Tue Jun  1 09:08:55 1999
+++ gnupg-1.0.2-memfix/mpi/mpiutil.c	Tue Jul 25 00:06:40 2000
@@ -388,14 +388,24 @@
     MPI b;
 
     if( a && (a->flags & 4) ) {
+#ifdef M_DEBUG
+	void *p = m_is_secure(a->d)? m_debug_alloc_secure( a->nbits, "alloc_like" )
+				   : m_debug_alloc( a->nbits, "alloc_like" );
+#else
 	void *p = m_is_secure(a->d)? m_alloc_secure( a->nbits )
 				   : m_alloc( a->nbits );
+#endif
 	memcpy( p, a->d, a->nbits );
 	b = mpi_set_opaque( NULL, p, a->nbits );
     }
     else if( a ) {
+#ifdef M_DEBUG
+	b = mpi_is_secure(a)? mpi_debug_alloc_secure( a->nlimbs, "alloc_like" )
+			    : mpi_debug_alloc( a->nlimbs, "alloc_like" );
+#else
 	b = mpi_is_secure(a)? mpi_alloc_secure( a->nlimbs )
 			    : mpi_alloc( a->nlimbs );
+#endif
 	b->nlimbs = 0;
 	b->sign = 0;
 	b->flags = a->flags;