From 76c8122adfed0f0f443cce7bda702ba2b39661b3 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Thu, 19 Feb 2015 16:29:58 +0100 Subject: gpg: Fix segv due to NULL value stored as opaque MPI. * g10/build-packet.c (gpg_mpi_write): Check for NULL return from gcry_mpi_get_opaque. (gpg_mpi_write_nohdr, do_key): Ditto. * g10/keyid.c (hash_public_key): Ditto. -- This fix extends commmit 0835d2f44ef62eab51fce6a927908f544e01cf8f. gpg2 --export --no-default-keyring --keyring TESTDATA With TESTDATA being below after unpacking. -----BEGIN PGP ARMORED FILE----- mBMEhdkMmS8BcX8F//8F5voEhQAQmBMEnAAAZwAAo4D/f/8EhQAAAIAEnP8EhQAQ iBMEnP8AAAAABf8jIID///8EhQYQmBMEnIUAEIgTBKT/AAAAAAUAACCA/f//BIUA EJgTBJx/AP8ABPPzBJx/AP8ABPPz =2yE0 -----END PGP ARMORED FILE----- Reported-by: Jodie Cunningham Signed-off-by: Werner Koch --- g10/keyid.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) (limited to 'g10/keyid.c') diff --git a/g10/keyid.c b/g10/keyid.c index 9f7b70fca..a0571b03b 100644 --- a/g10/keyid.c +++ b/g10/keyid.c @@ -179,7 +179,10 @@ hash_public_key (gcry_md_hd_t md, PKT_public_key *pk) p = gcry_mpi_get_opaque (pk->pkey[i], &nbits); pp[i] = xmalloc ((nbits+7)/8); - memcpy (pp[i], p, (nbits+7)/8); + if (p) + memcpy (pp[i], p, (nbits+7)/8); + else + pp[i] = NULL; nn[i] = (nbits+7)/8; n += nn[i]; } @@ -214,14 +217,18 @@ hash_public_key (gcry_md_hd_t md, PKT_public_key *pk) if(npkey==0 && pk->pkey[0] && gcry_mpi_get_flag (pk->pkey[0], GCRYMPI_FLAG_OPAQUE)) { - gcry_md_write (md, pp[0], nn[0]); + if (pp[0]) + gcry_md_write (md, pp[0], nn[0]); } else - for(i=0; i < npkey; i++ ) - { - gcry_md_write ( md, pp[i], nn[i] ); - xfree(pp[i]); - } + { + for(i=0; i < npkey; i++ ) + { + if (pp[i]) + gcry_md_write ( md, pp[i], nn[i] ); + xfree(pp[i]); + } + } } -- cgit v1.2.3