GnuPG Made Easy. http://git.bktus.com/gpgfrontend/gpgme/atom?h=gpgme-1.5.2 2014-11-21T20:12:06Z 2014-11-21T20:12:06Z Werner Koch wk@gnupg.org 2014-11-19T09:34:32Z urn:sha1:81ce87111f5a3f966188629abb07a4d0702e6db0 * src/sign.c (gpgme_op_sign_result): Reformat and take care of failed malloc. -- Although _gpgme_debug_trace() is current always true, the code should be run always and not just in trace mode. Also added error checking to malloc and strdup. And while at replace some while by for loop for easier readability. 2014-11-21T19:25:43Z Ben Kibbey bjk@luxsci.net 2014-11-09T21:42:54Z urn:sha1:5942b0c7e0593b82b4c4a142c214d7a2649de104 * src/sign.c (gpgme_op_sign_result): Test that invalid and valid signatures add up to gpgme_signers_count(). -- When invalid and valid signatures do not equal gpgme_signers_count() it means that there was a bad passphrase during signing after the first signer. This leaves the result.signatures from previous signers intact which isn't correct since gpg will report: gpg: number of one-pass packets does not match number of signature packets gpg: can't handle this ambiguous signature data during verify. So when this happens append the valid signatures to the .invalid_signers list with .reason set to GPG_ERR_GENERAL. 2014-11-06T14:59:06Z Werner Koch wk@gnupg.org 2014-11-06T14:59:06Z urn:sha1:8031341283f4fcb1f226aa6f66bc5a6042586815 * src/debug.h (TRACE_ERR): Include the line number in the output. 2014-10-02T13:57:50Z Werner Koch wk@gnupg.org 2014-10-02T13:48:53Z urn:sha1:4027a0a89724df3aeef8a964c529548d724b6a5a * configure.ac: Document SYSROOT. * m4/gpg-error.m4: Update from libgpg-error master. * src/gpgme.m4: Implement SYSROOT stuff. 2014-10-02T13:20:35Z Daniel Kahn Gillmor dkg@fifthhorseman.net 2014-09-29T21:48:39Z urn:sha1:b3309f997c541d7150827a659bffc38bc9f685fe -- The --no-sk-comments flag is (or should be) a no-op in modern versions of gnupg, but gpgme should still use its full form rather than the (slightly) abbreviated --no-sk-comment 2014-08-12T16:50:14Z Werner Koch wk@gnupg.org 2014-08-12T08:36:30Z urn:sha1:4160ef90a1b1b778c735f31f98a6966ba3b3ea90 * src/gpgme-tool.c (cmd_keylist): Print keyid. Print FPR only if available. 2014-08-12T16:47:39Z Werner Koch wk@gnupg.org 2014-08-12T08:36:30Z urn:sha1:3450bff52baef2c14118958cf79ead46940d58f0 * src/engine-gpg.c (read_colon_line): Split preprocessed lines. (gpg_keylist_preprocess): Limit keyid field and print fingerprint. 2014-08-12T15:51:38Z Werner Koch wk@gnupg.org 2014-08-12T08:36:30Z urn:sha1:488e44cdb531035fa8813b95b212f9728abc7e62 * src/Makefile.am (bin_PROGRAMS): New. Add gpgme-tools. (noinst_PROGRAMS): Remove. 2014-08-12T15:42:08Z Werner Koch wk@gnupg.org 2014-08-12T15:42:08Z urn:sha1:e5ab11607281b9838da2728268a8f9f0daa2b04d * src/gpgme-tool.c (result_xml_escape): Allow for DATA being NULL. 2014-07-30T09:04:55Z Werner Koch wk@gnupg.org 2014-07-30T09:04:55Z urn:sha1:2cbd76f7911fc215845e89b50d6af5ff4a83dd77 * src/engine-gpgsm.c (status_handler): * src/engine-uiserver.c (status_handler): -- After a realloc (realloc is also used for initial alloc) the allocated size if the buffer is not correctly recorded. Thus an overflow can be introduced by receiving data with different line lengths in a specific order. This is not easy exploitable because libassuan constructs the line. However a crash has been reported and thus it might be possible to constructs an exploit. CVE-id: CVE-2014-3564 Reported-by: Tomáš Trnka