diff options
Diffstat (limited to '')
| -rw-r--r-- | g10/parse-packet.c | 20 |
1 files changed, 17 insertions, 3 deletions
diff --git a/g10/parse-packet.c b/g10/parse-packet.c index 29565df07..363ade99f 100644 --- a/g10/parse-packet.c +++ b/g10/parse-packet.c @@ -2088,6 +2088,16 @@ parse_comment( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet ) { byte *p; + /* Cap comment packet at a reasonable value to avoid an integer + overflow in the malloc below. Comment packets are actually not + anymore define my OpenPGP and we even stopped to use our + private comment packet. */ + if (pktlen>65536) + { + log_error ("packet(%d) too large\n", pkttype); + iobuf_skip_rest (inp, pktlen, 0); + return G10ERR_INVALID_PACKET; + } packet->pkt.comment = xmalloc(sizeof *packet->pkt.comment + pktlen - 1); packet->pkt.comment->len = pktlen; p = packet->pkt.comment->data; @@ -2097,7 +2107,7 @@ parse_comment( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet ) if( list_mode ) { int n = packet->pkt.comment->len; fprintf (listfp, ":%scomment packet: \"", pkttype == PKT_OLD_COMMENT? - "OpenPGP draft " : "" ); + "OpenPGP draft " : "GnuPG " ); for(p=packet->pkt.comment->data; n; p++, n-- ) { if( *p >= ' ' && *p <= 'z' ) putc (*p, listfp); @@ -2161,6 +2171,7 @@ parse_plaintext( IOBUF inp, int pkttype, unsigned long pktlen, } mode = iobuf_get_noeof(inp); if( pktlen ) pktlen--; namelen = iobuf_get_noeof(inp); if( pktlen ) pktlen--; + /* Note that namelen will never exceeds 255 byte. */ pt = pkt->pkt.plaintext = xmalloc(sizeof *pkt->pkt.plaintext + namelen -1); pt->new_ctb = new_ctb; pt->mode = mode; @@ -2311,10 +2322,10 @@ parse_mdc( IOBUF inp, int pkttype, unsigned long pktlen, /* - * This packet is internally generated by PGG (by armor.c) to + * This packet is internally generated by GPG (by armor.c) to * transfer some information to the lower layer. To make sure that * this packet is really a GPG faked one and not one comming from outside, - * we first check that tehre is a unique tag in it. + * we first check that there is a unique tag in it. * The format of such a control packet is: * n byte session marker * 1 byte control type CTRLPKT_xxxxx @@ -2340,6 +2351,9 @@ parse_gpg_control( IOBUF inp, int pkttype, if ( sesmark[i] != iobuf_get_noeof(inp) ) goto skipit; } + if (pktlen > 4096) + goto skipit; /* Definitely too large. We skip it to avoid an + overflow in the malloc. */ if ( list_mode ) puts ("- gpg control packet"); |