[bug #62354] pgp fails to calculate the new format packet length of 192 to 8383 octets

[Xiaoxin Yang]

URL:
  <https://savannah.gnu.org/bugs/?62354>

                 Summary: pgp fails to calculate the new format packet length
of 192 to 8383 octets
                 Project: GNU GRUB
            Submitted by: xiaoxin
            Submitted on: Fri 22 Apr 2022 09:12:06 PM UTC
                Category: None
                Severity: Major
                Priority: 5 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
         Originator Name: 
        Originator Email: 
             Open/Closed: Open
                 Release: 
                 Release: Git master
         Discussion Lock: Any
         Reproducibility: Every Time
         Planned Release: None

    _______________________________________________________

Details:



In rfc4880:

section 4.2.2.2.  Two-Octet Lengths

   A two-octet Body Length header encodes a length of 192 to 8383
   octets.  It is recognized because its first octet is in the range 192
   to 223.  The body length is equal to:

       bodyLen = ((1st_octet - 192) << 8) + (2nd_octet) + 192

Code in grub-core/commands/pgp.c doesn't add 192:
  92       if (l < 224)
  93         {
  94           *len = (l - 192) << GRUB_CHAR_BIT;
  95           if (grub_file_read (sig, &l, sizeof (l)) != 1)
  96             return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("bad
signature"));
  97           *len |= l;
  98           return 0;
  99         }

A minor patch could fix it:

diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c
index c6766f044..baabcae35 100644
--- a/grub-core/commands/pgp.c
+++ b/grub-core/commands/pgp.c
@@ -95,6 +95,7 @@ read_packet_header (grub_file_t sig, grub_uint8_t *out_type,
grub_size_t *len)
          if (grub_file_read (sig, &l, sizeof (l)) != 1)
            return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("bad signature"));
          *len |= l;
+         *len += 192;
          return 0;
        }
       if (l == 255)





    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?62354>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/