Home GnuPG
Diffusion GnuPG 1e929abd20fa

gpg: Fix possible memory corruption in the armor parser.

Description

gpg: Fix possible memory corruption in the armor parser.

* g10/armor.c (armor_filter): Fix faulty double increment.

This fixes a bug in a code path which can only be reached with special
crafted input data and would then error out at an upper layer due to
corrupt input (every second byte in the buffer is unitialized
garbage). No fuzzing has yet hit this case and we don't have a test
case for this code path. However memory corruption can never be
tolerated as it always has the protential for remode code execution.

which fixed

Backported-from-master: 115d138ba599328005c5321c0ef9f00355838ca9

The bug was introduced on 1999-01-07 by me:

  • armor.c: Rewrote large parts.

which I fixed on 1999-03-02 but missed to fix the other case:

  • armor.c (armor_filter): Fixed armor bypassing.

Details

Provenance
wernerAuthored on Thu, Oct 23, 11:36 AM
Parents
rG4329e4746368: gpg: Avoid potential downgrade to SHA1 in 3rd party key signatures.
Branches
Unknown
Tags
Unknown