gpgme/src, branch gpgme-1.5.1 GnuPG Made Easy. http://git.bktus.com/gpgfrontend/gpgme/atom?h=gpgme-1.5.1 2014-07-30T09:04:55Z Fix possible realloc overflow for gpgsm and uiserver engines. 2014-07-30T09:04:55Z Werner Koch wk@gnupg.org 2014-07-30T09:04:55Z urn:sha1:2cbd76f7911fc215845e89b50d6af5ff4a83dd77 * src/engine-gpgsm.c (status_handler): * src/engine-uiserver.c (status_handler): -- After a realloc (realloc is also used for initial alloc) the allocated size if the buffer is not correctly recorded. Thus an overflow can be introduced by receiving data with different line lengths in a specific order. This is not easy exploitable because libassuan constructs the line. However a crash has been reported and thus it might be possible to constructs an exploit. CVE-id: CVE-2014-3564 Reported-by: Tomáš Trnka w32: Get IOSPAWN flag back in sync with spawn helper. 2014-06-26T08:42:56Z Werner Koch wk@gnupg.org 2014-06-25T18:25:28Z urn:sha1:68116fa5f67238a60bb8be375cc959262fa021d3 * src/gpgme-w32spawn.c: Include priv-io.h. w32: Add comment about a compiler warning 2014-06-26T08:41:46Z Werner Koch wk@gnupg.org 2014-06-25T18:25:28Z urn:sha1:efaf42205c5578c45bd1249cf777d893623eae35 -- Add new reason codes to the INV_RECP status code. 2014-06-10T12:52:06Z Werner Koch wk@gnupg.org 2014-06-10T12:52:06Z urn:sha1:86260b47c9e306e325103d1af767842357647e60 * src/op-support.c (_gpgme_parse_inv_recp): Add codes 13 and 14. Add new keylist mode GPGME_KEYLIST_MODE_WITH_SECRET. 2014-06-04T07:57:54Z Werner Koch wk@gnupg.org 2014-06-04T07:57:54Z urn:sha1:4dc9af24156b4fd52c7b76e7522b9b7a64e5386a * src/gpgme.h.in (GPGME_KEYLIST_MODE_WITH_SECRET): New. * src/engine-gpg.c (gpg_keylist_build_options): Handle new mode. * src/engine-gpgsm.c (gpgsm_keylist, gpgsm_keylist_ext): Ditto. * src/keylist.c (parse_sec_field15): Add arg key and take care of --with-secret output. * src/gpgme-tool.c (gt_get_keylist_mode, cmd_keylist_mode): Add "with_secret". Print card info and and secret flag for subkeys. -- Note: This mode may only be used with GnuPG >= 2.1. Add 6 new GPGME_STATUS_ codes. 2014-05-13T14:08:01Z Werner Koch wk@gnupg.org 2014-05-13T13:44:52Z urn:sha1:de6caeed6d6432101c673c35717f152d5facf823 * src/status-table.c: Also add missing DECRYPTION_INFO entry. Add field CURVE to the key info. 2014-05-08T18:39:15Z Werner Koch wk@gnupg.org 2014-05-08T18:39:15Z urn:sha1:88f15336ec0eadde68ff2618349efb9006b8e801 * src/gpgme.h.in (struct _gpgme_subkey): Add field CURVE. * src/key.c (gpgme_key_unref): Free CURVE. * src/keylist.c (keylist_colon_handler): Set CURVE. * src/gpgme.c (gpgme_release): For failsafe reasons reset engine and engine info after freeing. -- The engine hack is useful in case the other release functions accidently call engine release. Fix a memory access and a double slash bug. 2014-05-08T18:35:57Z Werner Koch wk@gnupg.org 2014-05-08T18:35:57Z urn:sha1:de4a1ea684e1591975feb801e7651309e1ee2c49 * src/engine-spawn.c (engspawn_start): Allocate space for list terminator. * src/posix-util.c (walk_path): Fix trailing slash detection. -- Kudos to Valgrind for pointing out these two problems. The first is a plain allocation bug in a code pattern I have written thousands of times - this time it went wrong. The allocation is not user controlled thus not directly exploitable. The second is missed to do what it intended to do. Found due to the access of malloced but not initialized memory. Not using calloc again proved to be helpful to detect logical error. Map public key algos returned by gpg to gpgme values. 2014-05-08T12:11:58Z Werner Koch wk@gnupg.org 2014-05-08T12:03:14Z urn:sha1:d5fb92cdaed21eea2f1a921e4f11df72635a8462 * src/conversion.c (_gpgme_map_pk_algo): New. * src/decrypt.c (parse_enc_to): Add arg PROTOCOL and map pubkey algo. (_gpgme_decrypt_status_handler): Map pubkey algo. * src/keylist.c (keylist_colon_handler): Map pubkey algo. * src/sign.c (parse_sig_created): Add arg PROTOCOL and map pubkey algo. * src/verify.c (parse_new_sig): Ditto. (parse_valid_sig): Ditto. * src/gpgme.h.in (GPGME_PK_ECC): New. (GPGME_MD_SHA224): New. * src/gpgme.c (gpgme_pubkey_algo_name): Add GPGME_PK_ECC case. (gpgme_hash_algo_name): Add GPGME_MD_SHA224. -- This affects only the not yet released ECC code of GnuPG 2.1. Add GPGME_ENCRYPT_NO_COMPRESS flag. 2014-05-08T09:31:30Z Werner Koch wk@gnupg.org 2014-05-08T09:31:30Z urn:sha1:991cde9e79fec70aad093ded383c5574d30f9388 * src/gpgme.h.in (GPGME_ENCRYPT_NO_COMPRESS): New. * src/engine-gpg.c (gpg_encrypt, gpg_encrypt_sign): Implement it. * src/gpgme-tool.c (_cmd_sign_encrypt): Add option --no-compress.