gpg: Also detect a plaintext packet before an encrypted packet.

* g10/mainproc.c (proc_encrypted): Print warning and later force an
error.
--

Note that when this error is triggered the plaintext from the literal
data packet has already been outputted before the BEGIN_DECRYPTION
status line.  We fail only later to get more information.  Callers
need to check and act upon the decryption error code anyway.

Thanks to Marcus for pointing out this case.

GnuPG-bug-id: 4000
Signed-off-by: Werner Koch <[email protected]>
(cherry picked from commit 344b548dc71657d0285d93f78f17a2663b5e586f)

1 files changed, 12 insertions, 0 deletions

diff --git a/g10/mainproc.c b/g10/mainproc.c
index e3be894aa..116b72a6b 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -532,6 +532,14 @@ static void
 proc_encrypted (CTX c, PACKET *pkt)
 {
   int result = 0;
+  int early_plaintext = literals_seen;
+
+  if (early_plaintext)
+    {
+      log_info (_("WARNING: multiple plaintexts seen\n"));
+      write_status_errcode ("decryption.early_plaintext", GPG_ERR_BAD_DATA);
+      /* We fail only later so that we can print some more info first.  */
+    }
 
   if (!opt.quiet)
     {
@@ -651,6 +659,10 @@ proc_encrypted (CTX c, PACKET *pkt)
   if (!result)
     result = decrypt_data (c->ctrl, c, pkt->pkt.encrypted, c->dek );
 
+  /* Trigger the deferred error.  */
+  if (!result && early_plaintext)
+    result = gpg_error (GPG_ERR_BAD_DATA);
+
   if (result == -1)
     ;
   else if (!result