diff options
| author | Werner Koch <[email protected]> | 2025-09-24 15:00:07 +0000 |
|---|---|---|
| committer | Werner Koch <[email protected]> | 2025-09-24 15:02:52 +0000 |
| commit | 7101a06cb9149a080664da4f9d8a791a57a5b83e (patch) | |
| tree | 1acee1c0ff450c7ed5d973e16cf9a00c185071ee | |
| parent | tests: Add checks for change-recipients (diff) | |
| download | gnupg-7101a06cb9149a080664da4f9d8a791a57a5b83e.tar.gz gnupg-7101a06cb9149a080664da4f9d8a791a57a5b83e.zip | |
dirmngr: Fix assertion failure due to wrong buffer length computation.
* dirmngr/ks-engine-ldap.c (ks_ldap_put): Chnage to use a string than
a memory buffer for INFO.
--
This avoids assertion failures for certain lengths of the INFO buffer
with the key listing. And the new code is much cleaner.
| -rw-r--r-- | dirmngr/ks-engine-ldap.c | 72 |
1 files changed, 38 insertions, 34 deletions
diff --git a/dirmngr/ks-engine-ldap.c b/dirmngr/ks-engine-ldap.c index 5f8af81c0..32efe26d4 100644 --- a/dirmngr/ks-engine-ldap.c +++ b/dirmngr/ks-engine-ldap.c @@ -2828,7 +2828,7 @@ extract_attributes (LDAPMod ***modlist, int *extract_state, gpg_error_t ks_ldap_put (ctrl_t ctrl, parsed_uri_t uri, void *data, size_t datalen, - void *info, size_t infolen) + void *info_arg, size_t infolen_arg) { gpg_error_t err = 0; int ldap_err; @@ -2839,9 +2839,8 @@ ks_ldap_put (ctrl_t ctrl, parsed_uri_t uri, LDAPMod **addlist = NULL; char *data_armored = NULL; int extract_state; - - /* The last byte of the info block. */ - const char *infoend = (const char *) info + infolen - 1; + char *info = info_arg; + char *info_buffer = NULL; /* Used in case we need to copy INFO. */ /* Enable this code to dump the modlist to /tmp/modlist.txt. */ #if 0 @@ -2852,14 +2851,32 @@ ks_ldap_put (ctrl_t ctrl, parsed_uri_t uri, #endif estream_t dump = NULL; - /* Elide a warning. */ - (void) ctrl; - if (dirmngr_use_tor ()) { return no_ldap_due_to_tor (ctrl); } + /* Make sure that INFO is a proper string. */ + if (!infolen_arg) + { + /* Too short - use an empty string. */ + info = info_buffer = xtrystrdup (""); + } + else if (info[infolen_arg-1]) + { + /* No terminating nul. Take a copy. */ + info_buffer = xtrymalloc (infolen_arg + 1); + if (!info_buffer) + { + err = gpg_error_from_syserror (); + goto out; + } + memcpy (info_buffer, info, infolen_arg); + info_buffer[infolen_arg] = '\0'; + info = info_buffer; + } + + /* Connect to the LDAP server to get its properties. */ err = my_ldap_connect (uri, 0, &ldap_conn, &basedn, NULL, NULL, &serverinfo); if (err || !basedn) { @@ -2923,8 +2940,8 @@ ks_ldap_put (ctrl_t ctrl, parsed_uri_t uri, if (dump) { es_fprintf(dump, "data (%zd bytes)\n", datalen); - es_fprintf(dump, "info (%zd bytes): '\n", infolen); - es_fwrite(info, infolen, 1, dump); + es_fprintf(dump, "info (%zd bytes): '\n", strlen (info)); + es_fwrite(info, strlen (info), 1, dump); es_fprintf(dump, "'\n"); } } @@ -2951,37 +2968,24 @@ ks_ldap_put (ctrl_t ctrl, parsed_uri_t uri, /* Assemble the INFO stuff into LDAP attributes */ extract_state = 0; - while (infolen > 0) + while (*info) { - char *temp = NULL; + char *newline; - char *newline = memchr (info, '\n', infolen); - if (! newline) - /* The last line is not \n terminated! Make a copy so we can - add a NUL terminator. */ - { - temp = xmalloc (infolen + 1); - memcpy (temp, info, infolen); - info = temp; - newline = (char *) info + infolen; - } - - *newline = '\0'; + newline = strchr (info, '\n'); + if (newline) + *newline = '\0'; /* Replace the LF */ extract_attributes (&addlist, &extract_state, info, (serverinfo & SERVERINFO_SCHEMAV2)); - infolen = infolen - ((uintptr_t) newline - (uintptr_t) info + 1); - info = newline + 1; - - /* Sanity check. */ - if (! temp) - log_assert ((char *) info + infolen - 1 == infoend); + if (newline) + { + *newline = '\n'; /* Restore the LF */ + info = newline + 1; /* and forward. */ + } else - { - log_assert (infolen == -1); - xfree (temp); - } + info += strlen (info); /* Forward to the Nul. */ } modlist_add (&addlist, "objectClass", "pgpKeyInfo"); @@ -3083,7 +3087,7 @@ ks_ldap_put (ctrl_t ctrl, parsed_uri_t uri, xfree (addlist); xfree (data_armored); - + xfree (info_buffer); return err; } |
