fixed m_alloc(0) bug and added checks to revkey and numrevkeys

4 files changed, 58 insertions, 39 deletions

diff --git a/g10/ChangeLog b/g10/ChangeLog
index 66d3152b1..7cb0532cb 100644
--- a/g10/ChangeLog
+++ b/g10/ChangeLog
@@ -1,3 +1,13 @@
+2002-05-04  Stefan Bellon  <[email protected]>
+
+	* free-packet.c (copy_public_key): Don't call m_alloc(0), therefore
+	added consistency check for revkey and numrefkeys.
+
+	* getkey.c (check_revocation_keys): Added consistency check for
+	revkey and numrefkeys.
+
+	* keyedit.c (show_key_with_all_names): Likewise.
+
 2002-05-03  David Shaw  <[email protected]>
 
 	* photoid.c: Provide default image viewer for Win32.
diff --git a/g10/free-packet.c b/g10/free-packet.c
index 1824806a5..7dada08f8 100644
--- a/g10/free-packet.c
+++ b/g10/free-packet.c
@@ -164,8 +164,14 @@ copy_public_key ( PKT_public_key *d, PKT_public_key *s)
 	for(i=0; i < n; i++ )
 	    d->pkey[i] = mpi_copy( s->pkey[i] );
     }
-    d->revkey=m_alloc(sizeof(struct revocation_key)*s->numrevkeys);
-    memcpy(d->revkey,s->revkey,sizeof(struct revocation_key)*s->numrevkeys);
+    if( !s->revkey && s->numrevkeys )
+        BUG();
+    if( s->numrevkeys ) {
+        d->revkey = m_alloc(sizeof(struct revocation_key)*s->numrevkeys);
+        memcpy(d->revkey,s->revkey,sizeof(struct revocation_key)*s->numrevkeys);
+    }
+    else
+        d->revkey = NULL;
     return d;
 }
 
diff --git a/g10/getkey.c b/g10/getkey.c
index b5948ff85..20bebf2ef 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -2314,25 +2314,25 @@ check_revocation_keys(PKT_public_key *pk,PKT_signature *sig)
       (ulong)sig->keyid[1]); */
 
   /* is the issuer of the sig one of our revokers? */
-  for(i=0;i<pk->numrevkeys;i++)
-    {
-      u32 keyid[2];
-
-      keyid_from_fingerprint(pk->revkey[i].fpr,MAX_FINGERPRINT_LEN,keyid);
-
-      if(keyid[0]==sig->keyid[0] && keyid[1]==sig->keyid[1])
-	{
-	  MD_HANDLE md;
-
-	  md=md_open(sig->digest_algo,0);
-	  hash_public_key(md,pk);
-	  if(signature_check(sig,md)==0)
-	    {
-	      rc=0;
-	      break;
-	    }
-	}
-    }
+  if( !pk->revkey && pk->numrevkeys )
+     BUG();
+  else
+      for(i=0;i<pk->numrevkeys;i++) {
+          u32 keyid[2];
+    
+          keyid_from_fingerprint(pk->revkey[i].fpr,MAX_FINGERPRINT_LEN,keyid);
+    
+          if(keyid[0]==sig->keyid[0] && keyid[1]==sig->keyid[1]) {
+              MD_HANDLE md;
+    
+              md=md_open(sig->digest_algo,0);
+              hash_public_key(md,pk);
+              if(signature_check(sig,md)==0) {
+                  rc=0;
+                  break;
+              }
+          }
+      }
 
   busy=0;
 
diff --git a/g10/keyedit.c b/g10/keyedit.c
index 775d8edbf..75c28c41a 100644
--- a/g10/keyedit.c
+++ b/g10/keyedit.c
@@ -1478,24 +1478,27 @@ show_key_with_all_names( KBNODE keyblock, int only_marked, int with_revoker,
                 }
 	    }
 
-	    if(with_revoker)
-             for(i=0;i<pk->numrevkeys;i++)
-               {
-                 u32 r_keyid[2];
-                 char *user;
- 
-                 keyid_from_fingerprint(pk->revkey[i].fpr,
-					MAX_FINGERPRINT_LEN,r_keyid);
- 
-                 user=get_user_id_string_native(r_keyid);
- 
-                 tty_printf(_("This key may be revoked by %s key %s%s\n"),
-                            pubkey_algo_to_string(pk->revkey[i].algid),
-                            user,
-                            pk->revkey[i].class&0x40?_(" (sensitive)"):"");
- 
-                 m_free(user);
-               }
+	    if(with_revoker) {
+	        if( !pk->revkey && pk->numrevkeys )
+	            BUG();
+	        else
+                    for(i=0;i<pk->numrevkeys;i++) {
+                        u32 r_keyid[2];
+                        char *user;
+           
+                        keyid_from_fingerprint(pk->revkey[i].fpr,
+				       	MAX_FINGERPRINT_LEN,r_keyid);
+           
+                        user=get_user_id_string_native(r_keyid);
+           
+                        tty_printf(_("This key may be revoked by %s key %s%s\n"),
+                                   pubkey_algo_to_string(pk->revkey[i].algid),
+                                   user,
+                                   pk->revkey[i].class&0x40?_(" (sensitive)"):"");
+           
+                        m_free(user);
+                      }
+            }
 
 	    tty_printf(_("%s%c %4u%c/%08lX  created: %s expires: %s"),
 			  node->pkt->pkttype == PKT_PUBLIC_KEY? "pub":"sub",