From 3ba091ab8c93c87741a451f579d63dd500d7621d Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 23 Jul 2019 10:07:17 -0400 Subject: gpg,gpgsm: Handle pkdecrypt responses with/without NUL terminators. * g10/call-agent.c (agent_pkdecrypt): accept but do not require NUL-terminated data from the agent. * sm/call-agent.c (gpgsm_agent_pkdecrypt): accept but do not require NUL-terminated data from the agent. GnuPG-bug-id: 4652 Signed-off-by: Daniel Kahn Gillmor --- g10/call-agent.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) (limited to 'g10/call-agent.c') diff --git a/g10/call-agent.c b/g10/call-agent.c index d55238311..62568fc76 100644 --- a/g10/call-agent.c +++ b/g10/call-agent.c @@ -2323,25 +2323,28 @@ agent_pkdecrypt (ctrl_t ctrl, const char *keygrip, const char *desc, return err; } - put_membuf (&data, "", 1); /* Make sure it is 0 terminated. */ buf = get_membuf (&data, &len); if (!buf) return gpg_error_from_syserror (); - log_assert (len); /* (we forced Nul termination.) */ - if (*buf != '(') + if (len == 0 || *buf != '(') { xfree (buf); return gpg_error (GPG_ERR_INV_SEXP); } - if (len < 13 || memcmp (buf, "(5:value", 8) ) /* "(5:valueN:D)\0" */ + if (len < 12 || memcmp (buf, "(5:value", 8) ) /* "(5:valueN:D)" */ { xfree (buf); return gpg_error (GPG_ERR_INV_SEXP); } - len -= 10; /* Count only the data of the second part. */ + while (buf[len-1] == 0) + len--; + if (buf[len-1] != ')') + return gpg_error (GPG_ERR_INV_SEXP); + len--; /* Drop the final close-paren. */ p = buf + 8; /* Skip leading parenthesis and the value tag. */ + len -= 8; /* Count only the data of the second part. */ n = strtoul (p, &endp, 10); if (!n || *endp != ':') -- cgit v1.2.3