~ubuntu-branches/ubuntu/precise/gnupg2/precise-updates

« back to all changes in this revision

Viewing changes to g10/keyring.c

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-03-27 08:20:03 UTC
  • Revision ID: package-import@ubuntu.com-20150327082003-doob38ydqdxubnf1
Tags: 2.0.17-2ubuntu2.12.04.6
* Screen responses from keyservers (LP: #1409117)
  - d/p/0001-Screen-keyserver-responses.patch
  - d/p/0002-Make-screening-of-keyserver-result-work-with-multi-k.patch
  - d/p/0003-Add-kbnode_t-for-easier-backporting.patch
  - d/p/0004-gpg-Fix-regression-due-to-the-keyserver-import-filte.patch
* Fix large key size regression from CVE-2014-5270 changes (LP: #1371766)
  - d/p/Add-build-and-runtime-support-for-larger-RSA-key.patch
  - debian/rules: build with --enable-large-secmem
* SECURITY UPDATE: invalid memory read via invalid keyring
  - debian/patches/CVE-2015-1606.patch: skip all packets not allowed in
    a keyring in g10/keyring.c.
  - CVE-2015-1606
* SECURITY UPDATE: memcpy with overlapping ranges
  - debian/patches/CVE-2015-1607.patch: use inline functions to convert
    buffer data to scalars in common/iobuf.c, g10/build-packet.c,
    g10/getkey.c, g10/keygen.c, g10/keyid.c, g10/main.h, g10/misc.c,
    g10/parse-packet.c, g10/tdbio.c, g10/trustdb.c, include/host2net.h,
    kbx/keybox-dump.c, kbx/keybox-openpgp.c, kbx/keybox-search.c,
    kbx/keybox-update.c, scd/apdu.c, scd/app-openpgp.c,
    scd/ccid-driver.c, scd/pcsc-wrapper.c, tools/ccidmon.c.
  - CVE-2015-1607

Show diffs side-by-side

added added

removed removed

Lines of Context:
412
412
            rc = G10ERR_INV_KEYRING;
413
413
            break;
414
414
        }
415
 
        if (pkt->pkttype == PKT_COMPRESSED) {
416
 
            log_error ("skipped compressed packet in keyring\n");
 
415
 
 
416
        /* Filter allowed packets.  */
 
417
        switch (pkt->pkttype){
 
418
          case PKT_PUBLIC_KEY:
 
419
          case PKT_PUBLIC_SUBKEY:
 
420
          case PKT_SECRET_KEY:
 
421
          case PKT_SECRET_SUBKEY:
 
422
          case PKT_USER_ID:
 
423
          case PKT_ATTRIBUTE:
 
424
          case PKT_SIGNATURE:
 
425
            break; /* Allowed per RFC.  */
 
426
          case PKT_RING_TRUST:
 
427
          case PKT_OLD_COMMENT:
 
428
          case PKT_COMMENT:
 
429
          case PKT_GPG_CONTROL:
 
430
            break; /* Allowed by us.  */
 
431
 
 
432
          default:
 
433
            log_error ("skipped packet of type %d in keyring\n",
 
434
                       (int)pkt->pkttype);
417
435
            free_packet(pkt);
418
436
            init_packet(pkt);
419
437
            continue;
484
502
    if (rc || !ret_kb)
485
503
        release_kbnode (keyblock);
486
504
    else {
487
 
        /*(duplicated form the loop body)*/
 
505
        /*(duplicated from the loop body)*/
488
506
        if ( pkt && pkt->pkttype == PKT_RING_TRUST
489
507
             && lastnode 
490
508
             && lastnode->pkt->pkttype == PKT_SIGNATURE