[bug #68020] Incorrect parsing of 2-octet OpenPGP Format Packet Lengths

--8323329-1714636915-1770329146=:2057544
Content-Type: TEXT/plain; CHARSET=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: inline

URL:=0A  <https://savannah.gnu.org/bugs/?68020>=0A=0A                 Summa=
ry: Incorrect parsing of 2-octet OpenPGP Format Packet=0ALengths=0A        =
           Group: GNU GRUB=0A               Submitter: shoesoft=0A         =
      Submitted: Thu 05 Feb 2026 10:05:40 PM UTC=0A                Category=
: Security=0A                Severity: Major=0A                Priority: 5 =
- Normal=0A              Item Group: Software Error=0A                  Sta=
tus: None=0A                 Privacy: Public=0A             Assigned to: No=
ne=0A         Originator Name:=0A        Originator Email:=0A             O=
pen/Closed: Open=0A         Discussion Lock: Unlocked=0A                 Re=
lease: Git master=0A                 Release:=0A         Reproducibility: E=
very Time=0A         Planned Release: None=0A=0A=0A    ____________________=
___________________________________=0A=0AFollow-up Comments:=0A=0A=0A------=
-------------------------------------------------=0ADate: Thu 05 Feb 2026 1=
0:05:40 PM UTC By: shoesoft <shoesoft>=0AI have embedded a public GPG key w=
ith grub-mkimage --pubkey. Booting fails=0Awith "error loading initial key:=
 bad signature"=0A=0AThe problem occurs when parsing 2-octet OpenPGP Format=
 Packet Lengths. RFC=0A9580 says:=0A=0A> 4.2.1.2. 2-Octet Lengths=0A> =0A> =
A 2-octet Body Length header encodes a length of 192 to 8383 octets. It is=
=0A> recognized because its first octet is in the range 192 to 223. The bod=
y=0A> length is equal to:=0A> =0A> bodyLen =3D ((1st_octet - 192) << 8) + (=
2nd_octet) + 192=0A=0Agrub code does not account for the final 192. Note th=
at the problem does not=0Aoccur with keys exported by gnupg. gnupg exports =
keys using the legacy packet=0Aformat, not the "new" OpenPGP format.=0A=0AT=
he following change fixes the problem for me:=0A=0A--- a/grub-core/commands=
/pgp.c=0A+++ b/grub-core/commands/pgp.c=0A@@ -95,6 +95,7 @@ read_packet_hea=
der (grub_file_t sig, grub_uint8_t *out_type,=0Agrub_size_t *len)=0A      i=
f (grub_file_read (sig, &l, sizeof (l)) !=3D 1)=0A        return grub_error=
 (GRUB_ERR_BAD_SIGNATURE, N_("bad signature"));=0A      *len |=3D l;=0A+   =
  *len +=3D 192;=0A      return 0;=0A    }=0A       if (l =3D=3D 255)=0A=0A=
=0A=0A=0A=0A=0A=0A=0A    __________________________________________________=
_____=0A=0AReply to this item at:=0A=0A  <https://savannah.gnu.org/bugs/?68=
020>=0A=0A_______________________________________________=0AMessage sent vi=
a Savannah=0Ahttps://savannah.gnu.org/=0A
--8323329-1714636915-1770329146=:2057544
Content-Type: APPLICATION/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCaYUUOgAKCRCqLAuaBUf3
Ti3yAQCVNLxU/diLH6Q6SUnZhIfJxc6VIBSxfkuD3Bbxwr+72AEAu9Lf1Yf7Mrpb
4dAApQa/jDOOLMmat689GUNtNNOT7Qs=
=NZCg
-----END PGP SIGNATURE-----

--8323329-1714636915-1770329146=:2057544--