Use inline functions to convert buffer data to scalars.

* common/host2net.h (buf16_to_ulong, buf16_to_uint): New.
(buf16_to_ushort, buf16_to_u16): New.
(buf32_to_size_t, buf32_to_ulong, buf32_to_uint, buf32_to_u32): New.
--

Commit 91b826a38880fd8a989318585eb502582636ddd8 was not enough to
avoid all sign extension on shift problems.  Hanno Böck found a case
with an invalid read due to this problem.  To fix that once and for
all almost all uses of "<< 24" and "<< 8" are changed by this patch to
use an inline function from host2net.h.

Signed-off-by: Werner Koch <[email protected]>

1 files changed, 12 insertions, 17 deletions

diff --git a/g10/keyid.c b/g10/keyid.c
index 662806b3e..9f7b70fca 100644
--- a/g10/keyid.c
+++ b/g10/keyid.c
@@ -35,6 +35,8 @@
 #include "keydb.h"
 #include "i18n.h"
 #include "rmd160.h"
+#include "host2net.h"
+
 
 #define KEYID_STR_SIZE 19
 
@@ -256,9 +258,9 @@ v3_keyid (gcry_mpi_t a, u32 *ki)
   else
     {
       p = buffer + nbytes - 8;
-      ki[0] = (p[0] << 24) | (p[1] <<16) | (p[2] << 8) | p[3];
+      ki[0] = buf32_to_u32 (p);
       p += 4;
-      ki[1] = (p[0] << 24) | (p[1] <<16) | (p[2] << 8) | p[3];
+      ki[1] = buf32_to_u32 (p);
     }
   xfree (buffer);
   return ki[1];
@@ -378,15 +380,8 @@ keystr_from_desc(KEYDB_SEARCH_DESC *desc)
       {
 	u32 keyid[2];
 
-	keyid[0] = ((unsigned char)desc->u.fpr[12] << 24
-                    | (unsigned char)desc->u.fpr[13] << 16
-                    | (unsigned char)desc->u.fpr[14] << 8
-                    | (unsigned char)desc->u.fpr[15]);
-	keyid[1] = ((unsigned char)desc->u.fpr[16] << 24
-                    | (unsigned char)desc->u.fpr[17] << 16
-                    | (unsigned char)desc->u.fpr[18] << 8
-                    | (unsigned char)desc->u.fpr[19]);
-
+	keyid[0] = buf32_to_u32 (desc->u.fpr+12);
+	keyid[1] = buf32_to_u32 (desc->u.fpr+16);
 	return keystr(keyid);
       }
 
@@ -427,8 +422,8 @@ keyid_from_pk (PKT_public_key *pk, u32 *keyid)
       if(md)
 	{
 	  dp = gcry_md_read ( md, 0 );
-	  keyid[0] = dp[12] << 24 | dp[13] << 16 | dp[14] << 8 | dp[15] ;
-	  keyid[1] = dp[16] << 24 | dp[17] << 16 | dp[18] << 8 | dp[19] ;
+	  keyid[0] = buf32_to_u32 (dp+12);
+	  keyid[1] = buf32_to_u32 (dp+16);
 	  lowbits = keyid[1];
 	  gcry_md_close (md);
 	  pk->keyid[0] = keyid[0];
@@ -474,8 +469,8 @@ keyid_from_fingerprint( const byte *fprint, size_t fprint_len, u32 *keyid )
   else
     {
       const byte *dp = fprint;
-      keyid[0] = dp[12] << 24 | dp[13] << 16 | dp[14] << 8 | dp[15] ;
-      keyid[1] = dp[16] << 24 | dp[17] << 16 | dp[18] << 8 | dp[19] ;
+      keyid[0] = buf32_to_u32 (dp+12);
+      keyid[1] = buf32_to_u32 (dp+16);
     }
 
   return keyid[1];
@@ -691,8 +686,8 @@ fingerprint_from_pk (PKT_public_key *pk, byte *array, size_t *ret_len)
   if (!array)
     array = xmalloc ( len );
   memcpy (array, dp, len );
-  pk->keyid[0] = dp[12] << 24 | dp[13] << 16 | dp[14] << 8 | dp[15] ;
-  pk->keyid[1] = dp[16] << 24 | dp[17] << 16 | dp[18] << 8 | dp[19] ;
+  pk->keyid[0] = buf32_to_u32 (dp+12);
+  pk->keyid[1] = buf32_to_u32 (dp+16);
   gcry_md_close( md);
 
   if (ret_len)