gpgme/src, branch gpgme-1.4.4 GnuPG Made Easy. http://git.bktus.com/gpgfrontend/gpgme/atom?h=gpgme-1.4.4 2014-07-30T09:17:41Z Fix possible realloc overflow for gpgsm and uiserver engines. 2014-07-30T09:17:41Z Werner Koch wk@gnupg.org 2014-07-30T09:04:55Z urn:sha1:1755f33a478aeb787f8cf0d55ad6c628c30ff473 * src/engine-gpgsm.c (status_handler): * src/engine-uiserver.c (status_handler): -- After a realloc (realloc is also used for initial alloc) the allocated size if the buffer is not correctly recorded. Thus an overflow can be introduced by receiving data with different line lengths in a specific order. This is not easy exploitable because libassuan constructs the line. However a crash has been reported and thus it might be possible to constructs an exploit. CVE-id: CVE-2014-3564 Reported-by: Tomáš Trnka Resolved conflicts: NEWS - removed w32: Fix another memleak on error. 2014-07-30T09:13:22Z Werner Koch wk@gnupg.org 2014-04-15T14:40:48Z urn:sha1:eee89ffd0193fd18114b5c3cb7d8544aa71b512a * src/w32-io.c (create_reader): free CTX. -- Found by Hans-Christoph Steiner with cppcheck. w32: Fix memleak in an error code paths. 2014-07-30T09:13:15Z Werner Koch wk@gnupg.org 2014-04-15T14:40:48Z urn:sha1:27f052b9df75c3703d3ceabab2d2615e46665fe1 * src/w32-io.c (create_writer): Free CTX in cased of bad FD. * src/w32-util.c (_gpgme_mkstemp): Free TMPNAME in case of a failed mkstemp. -- Found by Hans-Christoph Steiner with cppcheck. Fix possible zombie processes. 2014-07-30T09:13:08Z Werner Koch wk@gnupg.org 2014-04-15T10:25:45Z urn:sha1:1e488d3fd854bd9e340629ba9047d7385c1f3792 * src/posix-io.c (_gpgme_io_waitpid): Protect waitpid agains EINTR. (_gpgme_io_dup): Likewise. (_gpgme_io_connect): Likewise. -- GnuPG-bug-id: 1630 Avoid pointer arithmetic on void pointer. 2014-07-30T09:12:18Z Werner Koch wk@gnupg.org 2014-03-11T12:58:38Z urn:sha1:a175922f8a8a422aba08175c88c60cbc96113791 * src/gpgme.c (gpgme_io_writen): Use new var buffer. -- Reported-by: Albert Chin Change implementation return type to match the definition. 2014-07-30T09:12:17Z Werner Koch wk@gnupg.org 2014-03-11T12:54:21Z urn:sha1:97f9bec6d0d0a3fb4dab96b30349d25cf00a1af5 * src/gpgme.c (gpgme_get_sub_protocol): Change return type to gpgme_protocol_t. -- Yet another enum/int mismatch. Reported-by: Albert Chin. Fix type inconsistency between gpgme.h and gpgme.c. 2014-07-30T09:11:55Z Werner Koch wk@gnupg.org 2014-02-12T19:36:08Z urn:sha1:206bfb5a7953dcdebfdbc6fe6136240964659561 * src/gpgme.c (gpgme_set_pinentry_mode): Fix type of MODE. -- GnuPG-bug-id: 1617 Fix possible segv in the gpgme_op_card_edit. 2014-07-30T09:10:56Z Werner Koch wk@gnupg.org 2013-08-19T18:40:10Z urn:sha1:3150aeba4095c79038761f035748485052b4b9eb * src/edit.c (gpgme_op_edit_start, gpgme_op_card_edit_start): Do not deref a NULL KEY in TRACE_BEG. Add function gpgme_data_identify. 2013-08-09T17:19:26Z Werner Koch wk@gnupg.org 2013-08-09T17:19:26Z urn:sha1:8579091c4f6a36e6bb06fcfbd147a776166fd3ea * src/gpgme.h.in (gpgme_data_type_t): New. (gpgme_data_identify): New prototype. * src/data-identify.c: New. * src/parsetlv.c, src/parsetlv.h: New. Take from gpa. * src/libgpgme.vers, src/gpgme.def: Add gpgme_data_identify. * src/gpgme-tool.c (status): Add STATUS_IDENTIFY_RESULT. (gt_identify): New. (cmd_identify): New. (hlp_passwd): Move close to cmd_passwd. -- It is often useful to have a way to identify the data which needs processing. This is such a common task that it makes sense to implement this in gpgme to avoid diverging implementations. Prefer GnuPG-2 engines over GnuPG-1. 2013-08-02T13:25:23Z Werner Koch wk@gnupg.org 2013-08-02T13:25:23Z urn:sha1:a4c80126ae4754c8478c69a8a24a6ffd975485fc * src/util.h: Move some prototypes to ... * src/sys-util.h: New. * src/Makefile.am (main_sources): Add sys-util.h. * configure.ac (AH_VERBATIM): Add DIRSEP_C and DIRSEP_S. * src/dirinfo.c: Include sys-util.h. (WANT_GPG_NAME, WANT_GPGSM_NAME, WANT_G13_NAME) (WANT_UISRV_SOCKET): New. (dirinfo): Add corresponding fields. (parse_output): Add arg COMPONENTS and set new fields. (read_gpgconf_dirs): Add arg components and act upon it. (get_gpgconf_item): Call read_gpgconf_dirs two times. Add debug output. (_gpgme_get_default_gpg_name): New. (_gpgme_get_default_gpgsm_name): New. (_gpgme_get_default_g13_name): New. (_gpgme_get_default_gpgconf_name): New. (_gpgme_get_default_uisrv_socket): New. * src/engine-gpg.c, src/engine-g13.c, src/engine-gpgconf.c * src/engine-gpgsm.c, src/engine-uiserver.c: Change to use _gpgme_get_default_ instead of those from sys-util.h. * src/posix-util.c (_gpgme_get_gpg_path): Include sys-util.h. (_gpgme_get_uiserver_socket_path): Remove. * src/w32-util.c (_gpgme_get_gpg_path): Include sys-util.h. (_gpgme_get_uiserver_socket_path): Remove. -- The default engines names are now taken from the output of gpgconf. If gpgconf is not installed gpg 1 is assumed and locate the same was as gpgconf.