From c4b1bee51bbdd732b94b431a951481af99117703 Mon Sep 17 00:00:00 2001 From: Panu Matilainen Date: Thu, 30 Sep 2021 09:51:10 +0300 Subject: [PATCH 2/3] Process MPI's from all kinds of signatures No immediate effect but needed by the following commits. CVE: CVE-2021-3521 Upstream-Status: Backport [https://github.com/rpm-software-management/rpm/commit/b5e8bc74b] Signed-off-by: Changqing Li --- rpmio/rpmpgp.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c index 25f67048fd..509e777e6d 100644 --- a/rpmio/rpmpgp.c +++ b/rpmio/rpmpgp.c @@ -543,7 +543,7 @@ pgpDigAlg pgpDigAlgFree(pgpDigAlg alg) return NULL; } -static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo, uint8_t sigtype, +static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo, const uint8_t *p, const uint8_t *h, size_t hlen, pgpDigParams sigp) { @@ -556,10 +556,8 @@ static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo, uint8_t sigtype, int mpil = pgpMpiLen(p); if (pend - p < mpil) break; - if (sigtype == PGPSIGTYPE_BINARY || sigtype == PGPSIGTYPE_TEXT) { - if (sigalg->setmpi(sigalg, i, p)) - break; - } + if (sigalg->setmpi(sigalg, i, p)) + break; p += mpil; } @@ -619,7 +617,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen, } p = ((uint8_t *)v) + sizeof(*v); - rc = pgpPrtSigParams(tag, v->pubkey_algo, v->sigtype, p, h, hlen, _digp); + rc = pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp); } break; case 4: { pgpPktSigV4 v = (pgpPktSigV4)h; @@ -677,8 +675,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen, p += 2; if (p > hend) return 1; - - rc = pgpPrtSigParams(tag, v->pubkey_algo, v->sigtype, p, h, hlen, _digp); + rc = pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp); } break; default: rpmlog(RPMLOG_WARNING, _("Unsupported version of signature: V%d\n"), version); -- 2.17.1