summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support/gnupg/gnupg-1.4.7/GnuPG1-CVE-2012-6085.patch
diff options
context:
space:
mode:
authorRichard Purdie <richard.purdie@linuxfoundation.org>2017-03-02 12:04:08 +0000
committerRichard Purdie <richard.purdie@linuxfoundation.org>2017-03-07 20:05:31 +0000
commit2345af9b4829ed3eed5abf60f2483055649f8af7 (patch)
tree96a9a31e4b1957b93c4fe3eb669117d2752caf0d /meta/recipes-support/gnupg/gnupg-1.4.7/GnuPG1-CVE-2012-6085.patch
parentc4901328fe5cf912c0965e5b011b64a95a9bcb9d (diff)
downloadpoky-uninative-1.5.tar.gz
recipes: Move out stale GPLv2 versions to a seperate layeruninative-1.5
These are recipes where the upstream has moved to GPLv3 and these old versions are the last ones under the GPLv2 license. There are several reasons for making this move. There is a different quality of service with these recipes in that they don't get security fixes and upstream no longer care about them, in fact they're actively hostile against people using old versions. The recipes tend to need a different kind of maintenance to work with changes in the wider ecosystem and there needs to be isolation between changes made in the v3 versions and those in the v2 versions. There are probably better ways to handle a "non-GPLv3" system but right now having these in OE-Core makes them look like a first class citizen when I believe they have potential for a variety of undesireable issues. Moving them into a separate layer makes their different needs clearer, it also makes it clear how many of these there are. Some are probably not needed (e.g. mc), I also wonder whether some are useful (e.g. gmp) since most things that use them are GPLv3 only already. Someone could now more clearly see how to streamline the list of recipes here. I'm proposing we mmove to this separate layer for 2.3 with its future maintinership and testing to be determined in 2.4 and beyond. (From OE-Core rev: 19b7e950346fb1dde6505c45236eba6cd9b33b4b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-support/gnupg/gnupg-1.4.7/GnuPG1-CVE-2012-6085.patch')
-rw-r--r--meta/recipes-support/gnupg/gnupg-1.4.7/GnuPG1-CVE-2012-6085.patch64
1 files changed, 0 insertions, 64 deletions
diff --git a/meta/recipes-support/gnupg/gnupg-1.4.7/GnuPG1-CVE-2012-6085.patch b/meta/recipes-support/gnupg/gnupg-1.4.7/GnuPG1-CVE-2012-6085.patch
deleted file mode 100644
index 362717636b..0000000000
--- a/meta/recipes-support/gnupg/gnupg-1.4.7/GnuPG1-CVE-2012-6085.patch
+++ /dev/null
@@ -1,64 +0,0 @@
1commit f0b33b6fb8e0586e9584a7a409dcc31263776a67
2Author: Werner Koch <wk@gnupg.org>
3Date: Thu Dec 20 09:43:41 2012 +0100
4
5 gpg: Import only packets which are allowed in a keyblock.
6
7 * g10/import.c (valid_keyblock_packet): New.
8 (read_block): Store only valid packets.
9 --
10
11 A corrupted key, which for example included a mangled public key
12 encrypted packet, used to corrupt the keyring. This change skips all
13 packets which are not allowed in a keyblock.
14
15 GnuPG-bug-id: 1455
16
17 (cherry-picked from commit f795a0d59e197455f8723c300eebf59e09853efa)
18
19Upstream-Status: Backport
20CVE: CVE-2012-6085
21
22Signed-off-by: Saul Wold <sgw@linux.intel.com>
23
24diff --git a/g10/import.c b/g10/import.c
25index bfe02eb..a57b32e 100644
26--- a/g10/import.c
27+++ b/g10/import.c
28@@ -384,6 +384,27 @@ import_print_stats (void *hd)
29 }
30
31
32+/* Return true if PKTTYPE is valid in a keyblock. */
33+static int
34+valid_keyblock_packet (int pkttype)
35+{
36+ switch (pkttype)
37+ {
38+ case PKT_PUBLIC_KEY:
39+ case PKT_PUBLIC_SUBKEY:
40+ case PKT_SECRET_KEY:
41+ case PKT_SECRET_SUBKEY:
42+ case PKT_SIGNATURE:
43+ case PKT_USER_ID:
44+ case PKT_ATTRIBUTE:
45+ case PKT_RING_TRUST:
46+ return 1;
47+ default:
48+ return 0;
49+ }
50+}
51+
52+
53 /****************
54 * Read the next keyblock from stream A.
55 * PENDING_PKT should be initialzed to NULL
56@@ -461,7 +482,7 @@ read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root )
57 }
58 in_cert = 1;
59 default:
60- if( in_cert ) {
61+ if (in_cert && valid_keyblock_packet (pkt->pkttype)) {
62 if( !root )
63 root = new_kbnode( pkt );
64 else