common: Make openpgp_oid_to_str more robust.

* common/openpgp-oid.c (openpgp_oid_to_str): Take care of
gcry_mpi_get_opaque returning NULL.  Remove useless condition !BUF.
--

It is possible that an opaque MPI stores just a NULL pointer.  Take
care of that before incrementing the pointer.  We return an error in
this case because at least a length byte is required.

Found due to hint from stack 0.3:

  bug: anti-simplify
  model: |
    %tobool15 = icmp ne i8* %incdec.ptr, null, !dbg !567
    -->  true
  stack:
    - /home/wk/s/gnupg/common/openpgp-oid.c:220:0
  ncore: 1
  core:
    - /home/wk/s/gnupg/common/openpgp-oid.c:212:0
      - pointer overflow

Signed-off-by: Werner Koch <[email protected]>

1 files changed, 4 insertions, 2 deletions

diff --git a/common/openpgp-oid.c b/common/openpgp-oid.c
index ccb67bbaa..7a758016b 100644
--- a/common/openpgp-oid.c
+++ b/common/openpgp-oid.c
@@ -192,7 +192,9 @@ openpgp_oid_to_str (gcry_mpi_t a)
 
   valmask = (unsigned long)0xfe << (8 * (sizeof (valmask) - 1));
 
-  if (!a || !gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
+  if (!a
+      || !gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE)
+      || !(buf = gcry_mpi_get_opaque (a, &lengthi)))
     {
       gpg_err_set_errno (EINVAL);
       return NULL;
@@ -217,7 +219,7 @@ openpgp_oid_to_str (gcry_mpi_t a)
   string = p = xtrymalloc (length*(1+3)+2+1);
   if (!string)
     return NULL;
-  if (!buf || !length)
+  if (!length)
     {
       *p = 0;
       return string;