diff options
| author | Werner Koch <[email protected]> | 2019-05-21 14:25:56 +0000 |
|---|---|---|
| committer | Werner Koch <[email protected]> | 2019-05-21 14:25:56 +0000 |
| commit | 156788a43c20e38cd52f4f725395aff2c72142ff (patch) | |
| tree | d5a2f0a0b9eb9971b5d19105f647ea224a16b120 /g10/packet.h | |
| parent | gpg: Unify the the use of the print_pubkey_info functions. (diff) | |
| download | gnupg-156788a43c20e38cd52f4f725395aff2c72142ff.tar.gz gnupg-156788a43c20e38cd52f4f725395aff2c72142ff.zip | |
gpg: Do not allow creation of user ids larger than our parser allows.
* g10/parse-packet.c: Move max packet lengths constants to ...
* g10/packet.h: ... here.
* g10/build-packet.c (do_user_id): Return an error if too data is too
large.
* g10/keygen.c (write_uid): Return an error for too large data.
--
This can lead to keyring corruption becuase we expect that our parser
is abale to parse packts created by us. Test case is
gpg --batch --passphrase 'abc' -v \
--quick-gen-key $(yes 'a'| head -4000|tr -d '\n')
GnuPG-bug-id: 4532
Signed-off-by: Werner Koch <[email protected]>
Diffstat (limited to 'g10/packet.h')
| -rw-r--r-- | g10/packet.h | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/g10/packet.h b/g10/packet.h index d787bde9e..479f25044 100644 --- a/g10/packet.h +++ b/g10/packet.h @@ -33,6 +33,11 @@ #define DEBUG_PARSE_PACKET 1 +/* Maximum length of packets to avoid excessive memory allocation. */ +#define MAX_KEY_PACKET_LENGTH (256 * 1024) +#define MAX_UID_PACKET_LENGTH ( 2 * 1024) +#define MAX_COMMENT_PACKET_LENGTH ( 64 * 1024) +#define MAX_ATTR_PACKET_LENGTH ( 16 * 1024*1024) /* Constants to allocate static MPI arrays. */ #define PUBKEY_MAX_NPKEY OPENPGP_MAX_NPKEY |