Gnupg cannot handle extremely large keys on 32 bit Linux

[Alexander Feigl]

Am Montag 16 April 2007 schrieb Werner Koch:
> Hi,
>
> I think I found the problem:  In g10/gpg.h you find
>
>   /* Number of bits we accept when reading or writing MPIs. */
>   #define MAX_EXTERN_MPI_BITS 16384
>
> when writing it out with build-packet.c:mpi_write, we use a buffer if
> that length.  It should error out for too long values but there might be
> a corner case.  To check whether it works, change that constant to a
> larger or smaller value and watch what results.

Found it

--- gnupg-2.0.3/g10/build-packet.c      2006-10-18 15:50:43.000000000 +0200
+++ gnupg-2.0.3-fixed/g10/build-packet.c        2007-04-16 18:40:31.000000000 
+0200
@@ -157,7 +157,7 @@
 static int
 mpi_write (iobuf_t out, gcry_mpi_t a)
 {
-  char buffer[(MAX_EXTERN_MPI_BITS+7)/8];
+  char buffer[(MAX_EXTERN_MPI_BITS+7)/8+2];
   size_t nbytes;
   int rc;

Seems like this fixes the problem. mpi_write allocates 2 bytes less it should. 
It shouldn't be security relevant on usual architectures, but it is a bug for 
sure

The last MPI bytes of the MPI seem to be 0802, which is the content of int rc. 
On Mac you probably get 0000 because the endian is different