https://bugs.gentoo.org/855395 https://marc.info/?l=oss-security&m=165657063921408&w=2 https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commitdiff;h=7b1db7192e6e4d0cfc439b23b13831837c85bc21 From 7b1db7192e6e4d0cfc439b23b13831837c85bc21 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Tue, 14 Jun 2022 11:33:27 +0200 Subject: [PATCH] g10: Fix garbled status messages in NOTATION_DATA * g10/cpr.c (write_status_text_and_buffer): Fix off-by-one -- Depending on the escaping and line wrapping the computed remaining buffer length could be wrong. Fixed by always using a break to terminate the escape detection loop. Might have happened for all status lines which may wrap. GnuPG-bug-id: T6027 --- a/g10/cpr.c +++ b/g10/cpr.c @@ -328,20 +328,15 @@ write_status_text_and_buffer (int no, const char *string, } first = 0; } - for (esc=0, s=buffer, n=len; n && !esc; s++, n--) + for (esc=0, s=buffer, n=len; n; s++, n--) { if (*s == '%' || *(const byte*)s <= lower_limit || *(const byte*)s == 127 ) esc = 1; if (wrap && ++count > wrap) - { - dowrap=1; - break; - } - } - if (esc) - { - s--; n++; + dowrap=1; + if (esc || dowrap) + break; } if (s != buffer) es_fwrite (buffer, s-buffer, 1, statusfp);