Home GnuPG

gnome3: Avoid risk of uinitialized memory access.
15a6fd9f1ee0Unpublished

Unpublished Commit ยท Learn More

Not On Permanent Ref: This commit is not an ancestor of any permanent ref.

Description

gnome3: Avoid risk of uinitialized memory access.

* gnome3/pinentry-gnome3.c (_propagate_g_error_to_pinentry): Ensure
that pinentry->specific_err_info is null-terminated.

It's possible that "%d: %s" ends up producing more than 20 additional
characters. A 64-bit signed int at its minimum is
"-9223372036854775808", which is 20 characters. On any platform where
gint is 128-bit (i don't know whether they exist), it could be
significantly more.

snprintf doesn't write the final NUL byte if the string exceeds the
buffer, so anyone reading specific_err_info as a NUL-terminated string
in such a case would go on to read uninitialized memory after the
buffer. So we should force there to always be a NUL char after the
written buffer. It would be simpler to use asprintf, but i suspect
that's not portable enough for use in pinentry.

  • Signed-off-by: Neal H. Walfield <neal@g10code.com>

Details

Provenance
dkgAuthored on Nov 5 2016, 10:53 PM
nealCommitted on Nov 7 2016, 1:27 AM
Parents
rPe4e3a9cc8870: tty: Declare dummy curses_cmd_handler.
Branches
Unknown
Tags
Unknown