Page MenuHome GnuPG

Possible silent data loss when using GPG to pipe to a full disk
Closed, ResolvedPublic

Description

When using GPG as a filter (eg "cat thefile.gpg | gpg > output.txt"), if the
filesystem being written to is full, and the plaintext inside thefile.gpg small
enough, GPG can end up not writing the complete output, but will return success
back to the caller.

What seems to be happening is in plaintext.c:handle_plaintext(). At the end of
the function, the FILE * being written to is fclosed, but only if it isn't
stdout. In the filter case, of course, the output will be stdout, so it won't
get closed. Shortly afterwards, there is a fflush(stdout), but the return code
from this isn't checked. If the plaintext data is small enough so that the
stdio buffer was never flushed, then the first time there is a "real" write will
be when stdout is fflushed. The end result is that the data is not written to
disk (because the disk is full), but yet GPG thinks it was and returns success
back to the caller.

The fix should be fairly simple - just check the return code of that fflush. In
the filter case, this is important. In the non-filter case, it's harmless to check.

Details

Version
1.4.10

Event Timeline

dshaw set Version to 1.4.10.
dshaw added a subscriber: dshaw.

David already fixed that in 1.4.
Now fixed for 2.0 too.

werner claimed this task.