From d2b0e613131d52da54c3dbd72f4bfba8f7b71ad3 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Fri, 12 Dec 2014 10:41:25 +0100 Subject: gpg: Fix possible read of unallocated memory * g10/parse-packet.c (can_handle_critical): Check content length before calling can_handle_critical_notation. -- The problem was found by Jan Bee and gniibe proposed the used fix. Thanks. This bug can't be exploited: Only if the announced length of the notation is 21 or 32 a memcmp against fixed strings using that length would be done. The compared data is followed by the actual signature and thus it is highly likely that not even read of unallocated memory will happen. Nevertheless such a bug needs to be fixed. Signed-off-by: Werner Koch --- g10/parse-packet.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/g10/parse-packet.c b/g10/parse-packet.c index 63b97f05e..1048402d4 100644 --- a/g10/parse-packet.c +++ b/g10/parse-packet.c @@ -1196,10 +1196,13 @@ can_handle_critical( const byte *buffer, size_t n, int type ) switch( type ) { case SIGSUBPKT_NOTATION: - if(n>=8) - return can_handle_critical_notation(buffer+8,(buffer[4]<<8)|buffer[5]); - else - return 0; + if (n >= 8) + { + size_t notation_len = ((buffer[4] << 8) | buffer[5]); + if (n - 8 >= notation_len) + return can_handle_critical_notation (buffer + 8, notation_len); + } + return 0; case SIGSUBPKT_SIGNATURE: case SIGSUBPKT_SIG_CREATED: case SIGSUBPKT_SIG_EXPIRE: -- cgit v1.2.3