diff options
| author | Werner Koch <[email protected]> | 2014-06-20 08:39:26 +0000 |
|---|---|---|
| committer | Werner Koch <[email protected]> | 2014-06-20 08:41:38 +0000 |
| commit | d6ca407a27877174c10adfae9dc601bea996cf27 (patch) | |
| tree | f48dff88dc5a3a75e5a95a25d9188fe7fe00ccbb /g10/export.c | |
| parent | gpg: Fix a couple of spelling errors (diff) | |
| download | gnupg-d6ca407a27877174c10adfae9dc601bea996cf27.tar.gz gnupg-d6ca407a27877174c10adfae9dc601bea996cf27.zip | |
gpg: Avoid infinite loop in uncompressing garbled packets.
* g10/compress.c (do_uncompress): Limit the number of extra FF bytes.
--
A packet like (a3 01 5b ff) leads to an infinite loop. Using
--max-output won't help if it is a partial packet. This patch
actually fixes a regression introduced on 1999-05-31 (c34c6769).
Actually it would be sufficient to stuff just one extra 0xff byte.
Given that this problem popped up only after 15 years, I feel safer to
allow for a very few FF bytes.
Thanks to Olivier Levillain and Florian Maury for their detailed
report.
Diffstat (limited to 'g10/export.c')
0 files changed, 0 insertions, 0 deletions