← Back to branch summary

~ubuntu-branches/ubuntu/precise/gnupg2/precise-security

« back to all changes in this revision

Viewing changes to g10/build-packet.c

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-03-27 08:20:03 UTC
  • Revision ID: package-import@ubuntu.com-20150327082003-doob38ydqdxubnf1
Tags: 2.0.17-2ubuntu2.12.04.6
https://launchpad.net/bugs/1409117
https://launchpad.net/bugs/1371766
* Screen responses from keyservers (LP: #1409117)
  - d/p/0001-Screen-keyserver-responses.patch
  - d/p/0002-Make-screening-of-keyserver-result-work-with-multi-k.patch
  - d/p/0003-Add-kbnode_t-for-easier-backporting.patch
  - d/p/0004-gpg-Fix-regression-due-to-the-keyserver-import-filte.patch
* Fix large key size regression from CVE-2014-5270 changes (LP: #1371766)
  - d/p/Add-build-and-runtime-support-for-larger-RSA-key.patch
  - debian/rules: build with --enable-large-secmem
* SECURITY UPDATE: invalid memory read via invalid keyring
  - debian/patches/CVE-2015-1606.patch: skip all packets not allowed in
    a keyring in g10/keyring.c.
  - CVE-2015-1606
* SECURITY UPDATE: memcpy with overlapping ranges
  - debian/patches/CVE-2015-1607.patch: use inline functions to convert
    buffer data to scalars in common/iobuf.c, g10/build-packet.c,
    g10/getkey.c, g10/keygen.c, g10/keyid.c, g10/main.h, g10/misc.c,
    g10/parse-packet.c, g10/tdbio.c, g10/trustdb.c, include/host2net.h,
    kbx/keybox-dump.c, kbx/keybox-openpgp.c, kbx/keybox-search.c,
    kbx/keybox-update.c, scd/apdu.c, scd/app-openpgp.c,
    scd/ccid-driver.c, scd/pcsc-wrapper.c, tools/ccidmon.c.
  - CVE-2015-1607

Show diffs side-by-side

added added

removed removed

Lines of Context:
g10/build-packet.c
33
33
#include "cipher.h"
34
34
#include "i18n.h"
35
35
#include "options.h"
 
36
#include "../include/host2net.h"
36
37
 
37
38
static int do_user_id( IOBUF out, int ctb, PKT_user_id *uid );
38
39
static int do_public_key( IOBUF out, int ctb, PKT_public_key *pk );
631
632
        if( n == 255 ) {
632
633
            if( buflen < 4 )
633
634
                break;
634
 
            n = (buffer[0] << 24) | (buffer[1] << 16)
635
 
                | (buffer[2] << 8) | buffer[3];
 
635
            n = buf32_to_size_t (buffer);
636
636
            buffer += 4;
637
637
            buflen -= 4;
638
638
        }
755
755
        /* This should never happen since we don't currently allow
756
756
           creating such a subpacket, but just in case... */
757
757
      case SIGSUBPKT_SIG_EXPIRE:
758
 
        if(buffer_to_u32(buffer)+sig->timestamp<=make_timestamp())
 
758
        if (buf32_to_u32 (buffer) + sig->timestamp <= make_timestamp())
759
759
          sig->flags.expired=1;
760
760
        else
761
761
          sig->flags.expired=0;