Page MenuHome GnuPG
Create Task
Maniphest T4899

Undefined behavior in sm/certdump.c
Closed, ResolvedPublic
Actions

Description

Hi Everyone,

I just built GnuPG 2.2.20 release tarball.

The latest release still needs this patch to avoid undefined behavior when buffer is NULL:

--- sm/certdump.c
+++ sm/certdump.c
@@ -695,9 +695,13 @@
       gpg_err_set_errno (c->error);
       return -1;
     }
-  memcpy (p + c->len, buffer, size);
-  c->len += size;
-  p[c->len] = 0; /* Terminate string. */
+
+  if (p && buffer)
+    {
+      memcpy (p + c->len, buffer, size);
+      c->len += size;
+    }
+    p[c->len] = 0; /* Terminate string. */
 
   return (gpgrt_ssize_t)size;
 }

You should be able to tickle the ub by adding -fsantize=undefined to CFLAGS and LDFLAGS, and then running the test suite.

Details

Version
2.2.20

Related Objects