From c4b1bee51bbdd732b94b431a951481af99117703 Mon Sep 17 00:00:00 2001 From: Panu Matilainen Date: Thu, 30 Sep 2021 09:51:10 +0300 Subject: [PATCH 2/3] Process MPI's from all kinds of signatures No immediate effect but needed by the following commits. CVE: CVE-2021-3521 Upstream-Status: Backport[https://github.com/rpm-software-management/rpm/commit/b5e8bc74b] Signed-off-by: Changqing Li --- rpmio/rpmpgp.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c index e472b5320f..57d411d1e0 100644 --- a/rpmio/rpmpgp.c +++ b/rpmio/rpmpgp.c @@ -515,7 +515,7 @@ pgpDigAlg pgpDigAlgFree(pgpDigAlg alg) return NULL; } -static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo, uint8_t sigtype, +static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo, const uint8_t *p, const uint8_t *h, size_t hlen, pgpDigParams sigp) { @@ -528,10 +528,8 @@ static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo, uint8_t sigtype, int mpil = pgpMpiLen(p); if (p + mpil > pend) break; - if (sigtype == PGPSIGTYPE_BINARY || sigtype == PGPSIGTYPE_TEXT) { - if (sigalg->setmpi(sigalg, i, p)) - break; - } + if (sigalg->setmpi(sigalg, i, p)) + break; p += mpil; } @@ -604,7 +602,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen, } p = ((uint8_t *)v) + sizeof(*v); - rc = pgpPrtSigParams(tag, v->pubkey_algo, v->sigtype, p, h, hlen, _digp); + rc = pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp); } break; case 4: { pgpPktSigV4 v = (pgpPktSigV4)h; @@ -662,7 +660,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen, if (p > (h + hlen)) return 1; - rc = pgpPrtSigParams(tag, v->pubkey_algo, v->sigtype, p, h, hlen, _digp); + rc = pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp); } break; default: rpmlog(RPMLOG_WARNING, _("Unsupported version of key: V%d\n"), version); -- 2.17.1