Re: [PATCH] cipher:pk:sexp: Remove bogus checks in SEXP parsing.

Jacob Bachmeyer via Gcrypt-devel <[email protected]> Tue, 17 Jun 2025 20:55:16 -0500
Newsgroups gmane.comp.encryption.gpg.libgcrypt.devel
Message-ID <[email protected]>
On 6/17/25 00:31, NIIBE Yutaka via Gcrypt-devel wrote:
> * cipher/pubkey-util.c (_gcry_pk_util_data_to_mpi): Remove bogus check
> for VALUELEN.

NACK!  NACK!  NACK!

Those are checks for integer overflow.  (They may even be correct if 
VALUELEN is unsigned.)

If VALUELEN is a signed type, they are undefined behavior and need to be 
fixed, not removed.


-- Jacob


_______________________________________________
Gcrypt-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gcrypt-devel