swendel/nixpkgs
1
0
Fork 0
mirror of https://github.com/SebastianWendel/nixpkgs.git synced 2024-09-20 12:29:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

gnupg: Add patch for CVE-2022-34903

Browse source 
https://www.openwall.com/lists/oss-security/2022/06/30/1
https://dev.gnupg.org/T6027
This commit is contained in:
Stig Palmquist 2022-07-03 03:42:49 +02:00
parent 1b2929cd91
commit 3d0e70ae2a
No known key found for this signature in database
GPG key ID: 6A0B75A8D9DCC005
2 changed files with 48 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
pkgs/tools/security/gnupg/23.nix
View file

@ -34,6 +34,9 @@ stdenv.mkDerivation rec {
./tests-add-test-cases-for-import-without-uid.patch
./allow-import-of-previously-known-keys-even-without-UI.patch
./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
# Patch from upstream 34c649b36013, https://dev.gnupg.org/T6027
./CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch
];
postPatch = ''
sed -i 's,\(hkps\|https\)://keyserver.ubuntu.com,hkps://keys.openpgp.org,g' configure configure.ac doc/dirmngr.texi doc/gnupg.info-1

45
pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch Normal file
View file

@ -0,0 +1,45 @@
commit 34c649b3601383cd11dbc76221747ec16fd68e1b
Author: Werner Koch <wk@gnupg.org>
Date: 2022-06-14 11:33:27 +0200
g10: Fix garbled status messages in NOTATION_DATA
* g10/cpr.c (write_status_text_and_buffer): Fix off-by-one
--
Depending on the escaping and line wrapping the computed remaining
buffer length could be wrong. Fixed by always using a break to
terminate the escape detection loop. Might have happened for all
status lines which may wrap.
GnuPG-bug-id: T6027
diff --git a/g10/cpr.c b/g10/cpr.c
index 9bfdd3c34..fa8005d6f 100644
--- a/g10/cpr.c
+++ b/g10/cpr.c
@@ -372,20 +372,15 @@ write_status_text_and_buffer (int no, const char *string,
}
first = 0;
}
- for (esc=0, s=buffer, n=len; n && !esc; s++, n--)
+ for (esc=0, s=buffer, n=len; n; s++, n--)
{
if (*s == '%' || *(const byte*)s <= lower_limit
|| *(const byte*)s == 127 )
esc = 1;
if (wrap && ++count > wrap)
- {
- dowrap=1;
- break;
- }
- }
- if (esc)
- {
- s--; n++;
+ dowrap=1;
+ if (esc || dowrap)
+ break;
}
if (s != buffer)
es_fwrite (buffer, s-buffer, 1, statusfp);