[PATCH] cipher:pk:sexp: Remove bogus checks in SEXP parsing.
NIIBE Yutaka via Gcrypt-devel <[email protected]> Tue, 17 Jun 2025 14:31:55 +0900
| Newsgroups | gmane.comp.encryption.gpg.libgcrypt.devel |
|---|---|
| Message-ID | <45476b1c3c831973ef54c757ee0b81579091ecf5.1750138237.git.gniibe@fsij.org> |
* cipher/pubkey-util.c (_gcry_pk_util_data_to_mpi): Remove bogus check for VALUELEN. -- Fixes-commit: 37d0a1ebdc2dc74df4fb6bf0621045018122a68f Signed-off-by: NIIBE Yutaka <[email protected]> --- cipher/pubkey-util.c | 20 -------------------- 1 file changed, 20 deletions(-) _______________________________________________ Gcrypt-devel mailing list [email protected] https://lists.gnupg.org/mailman/listinfo/gcrypt-devel
0001-cipher-pk-sexp-Remove-bogus-checks-in-SEXP-parsing.patch
(text/x-patch, 1.8 KB)
diff --git a/cipher/pubkey-util.c b/cipher/pubkey-util.c
index 5a16d2f1..37a9f05b 100644
--- a/cipher/pubkey-util.c
+++ b/cipher/pubkey-util.c
@@ -806,11 +806,6 @@ _gcry_pk_util_data_to_mpi (gcry_sexp_t input, gcry_mpi_t *ret_mpi,
if (!value)
rc = gpg_err_code_from_syserror ();
}
- else if ((valuelen * 8) < valuelen)
- {
- xfree (value);
- rc = GPG_ERR_TOO_LARGE;
- }
if (rc)
goto leave;
@@ -878,11 +873,6 @@ _gcry_pk_util_data_to_mpi (gcry_sexp_t input, gcry_mpi_t *ret_mpi,
if ( !(value=sexp_nth_buffer (lvalue, 1, &valuelen)) || !valuelen )
rc = GPG_ERR_INV_OBJ;
- else if ((valuelen * 8) < valuelen)
- {
- xfree (value);
- rc = GPG_ERR_TOO_LARGE;
- }
else
*ret_mpi = mpi_set_opaque (NULL, value, valuelen*8);
}
@@ -926,11 +916,6 @@ _gcry_pk_util_data_to_mpi (gcry_sexp_t input, gcry_mpi_t *ret_mpi,
else if ( !(value=sexp_nth_buffer (lhash, 2, &valuelen))
|| !valuelen )
rc = GPG_ERR_INV_OBJ;
- else if ((valuelen * 8) < valuelen)
- {
- xfree (value);
- rc = GPG_ERR_TOO_LARGE;
- }
else
*ret_mpi = mpi_set_opaque (NULL, value, valuelen*8);
}
@@ -1040,11 +1025,6 @@ _gcry_pk_util_data_to_mpi (gcry_sexp_t input, gcry_mpi_t *ret_mpi,
if ( !(value=sexp_nth_buffer (lvalue, 1, &valuelen)) || !valuelen )
rc = GPG_ERR_INV_OBJ;
- else if ((valuelen * 8) < valuelen)
- {
- xfree (value);
- rc = GPG_ERR_TOO_LARGE;
- }
else
{
void *hash;