diff options
| author | Katarina Behrens <Katarina.Behrens@cib.de> | 2017-07-14 14:03:31 +0200 |
|---|---|---|
| committer | Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de> | 2017-07-14 16:41:25 +0200 |
| commit | d54e3f4af4696f5b47d13c2e768356532887f181 (patch) | |
| tree | 747282e9b5cdabf6d0d7a69a352caa931434f639 /xmlsecurity | |
| parent | 89f6c41abffd2885b7083ab0ef94da89c8b2c770 (diff) | |
gpg4libre: Don't use xmlStrlen on binary data
Odd things happen inside gpgme if the buffer is prematurely
truncated due to \n char and valid signature is then evaluated
as invalid
Change-Id: I24d4d22af06a3dde6eb7fdfc12953cf1b5f19c1e
Reviewed-on: https://gerrit.libreoffice.org/39947
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de>
Diffstat (limited to 'xmlsecurity')
| -rw-r--r-- | xmlsecurity/source/gpg/xmlsignature_gpgimpl.cxx | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/xmlsecurity/source/gpg/xmlsignature_gpgimpl.cxx b/xmlsecurity/source/gpg/xmlsignature_gpgimpl.cxx index 1667af6f59ad..0700c43f1ea6 100644 --- a/xmlsecurity/source/gpg/xmlsignature_gpgimpl.cxx +++ b/xmlsecurity/source/gpg/xmlsignature_gpgimpl.cxx @@ -359,12 +359,13 @@ SAL_CALL XMLSignature_GpgImpl::validate( if(!xmlSecCheckNodeName(cur, xmlSecNodeSignatureValue, xmlSecDSigNs)) throw RuntimeException("The GpgME library failed to initialize for the OpenPGP protocol."); xmlChar* pSignatureValue=xmlNodeGetContent(cur); - if(xmlSecBase64Decode(pSignatureValue, reinterpret_cast<xmlSecByte*>(pSignatureValue), xmlStrlen(pSignatureValue)) < 0) + int nSigSize = xmlSecBase64Decode(pSignatureValue, reinterpret_cast<xmlSecByte*>(pSignatureValue), xmlStrlen(pSignatureValue)); + if( nSigSize < 0) throw RuntimeException("The GpgME library failed to initialize for the OpenPGP protocol."); GpgME::Data data_signature( reinterpret_cast<char*>(pSignatureValue), - xmlStrlen(pSignatureValue), false); + nSigSize, false); GpgME::VerificationResult verify_res=rCtx.verifyDetachedSignature( data_signature, data_text); |