diff options
| author | Werner Koch <[email protected]> | 2013-11-15 07:36:39 +0000 |
|---|---|---|
| committer | Werner Koch <[email protected]> | 2013-11-15 08:01:11 +0000 |
| commit | 9ae48b173c93f4747a9826beb1fbd023c4362c22 (patch) | |
| tree | a9b7abdb827b7849e0016ce5761c89d24987a6db /kbx/keybox-dump.c | |
| parent | Require Libgcrypt 1.6 (diff) | |
| download | gnupg-9ae48b173c93f4747a9826beb1fbd023c4362c22.tar.gz gnupg-9ae48b173c93f4747a9826beb1fbd023c4362c22.zip | |
kbx: Fix possible segv in kbxdump.
* kbx/keybox-dump.c (_keybox_dump_blob): Check length before get32.
Signed-off-by: Werner Koch <[email protected]>
Diffstat (limited to 'kbx/keybox-dump.c')
| -rw-r--r-- | kbx/keybox-dump.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kbx/keybox-dump.c b/kbx/keybox-dump.c index c397f9c81..1af6a9cba 100644 --- a/kbx/keybox-dump.c +++ b/kbx/keybox-dump.c @@ -402,7 +402,7 @@ _keybox_dump_blob (KEYBOXBLOB blob, FILE *fp) n = get32 (p ); p += 4; fprintf (fp, "Reserved-Space: %lu\n", n ); - if (unhashed >= 24) + if (n >= 4 && unhashed >= 24) { n = get32 ( buffer + length - unhashed); fprintf (fp, "Storage-Flags: %08lx\n", n ); |