The following signature causes GPA 0.8.0 (installed from Gpg4win binary) to
crash in a reproducible manner on a Windows Vista workstation when the message
is copied and pasted to the "clipboard" menu and the signature is validated by
clicking the "validate" button.
MESSAGE STARTS HERE - DO NOT COPY THIS LINE
Sure, although I think at least one of them will be false / gone away in
HEAD.
- -Andy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkm3YPsACgkQOjLpvpq7dMqQowCffxGnEX3X6/+VmNKCEGyvVR+j
4IYAn2mibbitzGT7hUheC+L79L9RtSW3
spXc
-----END PGP SIGNATURE-----
MESSAGE ENDS HERE - DO NOT COPY THIS LINE
I investigated this issue and found out that it has to do with the Windows-only
function call "dos_to_unix" (caller: file "clipboard.c", Ln 468). This function
does not check whether the first argument is actually a NULL pointer (which it
is, in my case), dereferences it while checking if it is an ASCII string
delimiter (ASCII 00) (File: gpgmetools.c, Ln: 274) and crashes the program
thereby. It seems GPA seems to rely solely on the g_utf8_validate function to
determine whether that buffer is valid or not (this function, however, also
returns true if the buffer is null, at least ot my platform). Proposed fix: Have
dos_to_unix check if the supplied pointer is garbage before dereferencing it.