GpgFrontend/gpgme
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix possible realloc overflow for gpgsm and uiserver engines.

Browse Source 
* src/engine-gpgsm.c (status_handler):
* src/engine-uiserver.c (status_handler):
--

After a realloc (realloc is also used for initial alloc) the allocated
size if the buffer is not correctly recorded.  Thus an overflow can be
introduced by receiving data with different line lengths in a specific
order.  This is not easy exploitable because libassuan constructs the
line.  However a crash has been reported and thus it might be possible
to constructs an exploit.

CVE-id: CVE-2014-3564
Reported-by: Tomáš Trnka

Resolved conflicts:
	NEWS - removed
This commit is contained in:
Werner Koch 2014-07-30 11:04:55 +02:00
parent eee89ffd01
commit 1755f33a47
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/engine-gpgsm.c
View File

@ -837,7 +837,7 @@ status_handler (void *opaque, int fd)
else
{
*aline = newline;
gpgsm->colon.attic.linesize += linelen + 1;
gpgsm->colon.attic.linesize = *alinelen + linelen + 1;
}
}
if (!err)

2
src/engine-uiserver.c
View File

@ -698,7 +698,7 @@ status_handler (void *opaque, int fd)
else
{
*aline = newline;
uiserver->colon.attic.linesize += linelen + 1;
uiserver->colon.attic.linesize = *alinelen + linelen + 1;
}
}
if (!err)