Hello,
Thanks for your reviewing and reporting. This message is Cc-ed to
gnupg-devel.
On 12/19/2014 07:24 PM, Joshua Rogers wrote:
> Package: gnupg2
> Version: 2.1.1
> Severity: normal
>
> in dirmngr/ldap.c on line 617, argv may be overflowed.
>
> 617: argv[argc++] = url;
>
> a check is made on line 591 that checks to see whether argv is less than or
> email to 399, and if it does, exit.
> But argv is char *argv[50], while argc is a normal int.
> If argc is 398, it will pass that check.
Right.
Here's my fix. I'm going to apply this change since it's obvious
simple fix and there will be no conflict.
diff --git a/dirmngr/ldap.c b/dirmngr/ldap.c
index 478fdfd..00df167 100644
--- a/dirmngr/ldap.c
+++ b/dirmngr/ldap.c
@@ -588,7 +588,7 @@ start_cert_fetch_ldap (ctrl_t ctrl, cert_fetch_context_t
*context,
strlist_t sl;
char *url;
- if (argc >= sizeof argv -1)
+ if (argc >= DIM (argv) - 1)
{
/* Too many patterns. It does not make sense to allow an
arbitrary number of patters because the length of the
--
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
