OpenPKG CVS Repository
http://cvs.openpkg.org/
____________________________________________________________________________
Server: cvs.openpkg.org Name: Ralf S. Engelschall
Root: /v/openpkg/cvs Email: [EMAIL PROTECTED]
Module: openpkg-src Date: 25-Jun-2006 19:20:09
Branch: OPENPKG_2_5_SOLID Handle: 2006062518200900
Modified files: (Branch: OPENPKG_2_5_SOLID)
openpkg-src/gnupg gnupg.patch gnupg.spec
Log:
Security Fix (CVE-2006-3082)
Summary:
Revision Changes Path
1.5.8.2 +29 -0 openpkg-src/gnupg/gnupg.patch
1.55.2.3 +1 -1 openpkg-src/gnupg/gnupg.spec
____________________________________________________________________________
patch -p0 <<'@@ .'
Index: openpkg-src/gnupg/gnupg.patch
============================================================================
$ cvs diff -u -r1.5.8.1 -r1.5.8.2 gnupg.patch
--- openpkg-src/gnupg/gnupg.patch 17 Feb 2006 22:48:26 -0000 1.5.8.1
+++ openpkg-src/gnupg/gnupg.patch 25 Jun 2006 17:20:09 -0000 1.5.8.2
@@ -72,3 +72,32 @@
default: p = buf; sprintf(buf, "g10err=%d", err); break;
}
#undef X
+
+=============================================================================
+
+Security Fix (CVE-2006-3082)
+
+Index: g10/parse-packet.c
+--- g10/parse-packet.c.orig 2005-06-18 13:29:34 +0200
++++ g10/parse-packet.c 2006-06-25 19:17:27 +0200
+@@ -1983,6 +1983,20 @@
+ {
+ byte *p;
+
++ /* Cap the size of a user ID at 2k: a value absurdly large enough
++ that there is no sane user ID string (which is printable text
++ as of RFC2440bis) that won't fit in it, but yet small enough to
++ avoid allocation problems. A large pktlen may not be
++ allocatable, and a very large pktlen could actually cause our
++ allocation to wrap around in xmalloc to a small number. */
++
++ if(pktlen>2048)
++ {
++ log_error("packet(%d) too large\n", pkttype);
++ iobuf_skip_rest(inp, pktlen, 0);
++ return G10ERR_INVALID_PACKET;
++ }
++
+ packet->pkt.user_id = m_alloc(sizeof *packet->pkt.user_id + pktlen);
+ packet->pkt.user_id->len = pktlen;
+
@@ .
patch -p0 <<'@@ .'
Index: openpkg-src/gnupg/gnupg.spec
============================================================================
$ cvs diff -u -r1.55.2.2 -r1.55.2.3 gnupg.spec
--- openpkg-src/gnupg/gnupg.spec 17 Feb 2006 22:48:26 -0000 1.55.2.2
+++ openpkg-src/gnupg/gnupg.spec 25 Jun 2006 17:20:09 -0000 1.55.2.3
@@ -33,7 +33,7 @@
Group: Cryptography
License: GPL
Version: 1.4.2
-Release: 2.5.1
+Release: 2.5.2
# package options
%option with_idea no
@@ .
______________________________________________________________________
The OpenPKG Project www.openpkg.org
CVS Repository Commit List openpkg-cvs@openpkg.org
