php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #59290 gnupg_verify() segfault on 64bit OS
Submitted: 2010-07-02 04:38 UTC Modified: 2010-07-20 15:27 UTC
From: viktors at ok dot lv Assigned:
Status: Closed Package: gnupg (PECL)
PHP Version: 5.3.2 OS: linux 64bit
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: viktors at ok dot lv
New email:
PHP Version: OS:

 

 [2010-07-02 04:38 UTC] viktors at ok dot lv 
Description:
------------
In gnupg_verify() gets called:
char * gpgme_data_release_and_get_mem (gpgme_data_t dh, size_t *length), where second argument should be pointer to size_t type variable. However, gpg_plain_len variable is defined as int which on 64bit OS is 4 bytes, but size_t on 64bit OS is 8 bytes. Memory gets corrupted.
Here is the patch that fixes it:
--- gnupg.c.orig	2010-07-02 10:44:22.000000000 +0300
+++ gnupg.c	2010-07-02 11:37:40.000000000 +0300
@@ -1096,7 +1096,7 @@
 	zval	*plain_text		=	NULL; /* signed_text without the signature if its not a detached sig */
 
 	char	*gpg_plain;
-	int		gpg_plain_len;
+	size_t		gpg_plain_len;
 
 	GNUPG_GETOBJ();

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-07-20 15:27 UTC] mgdm@php.net 
This bug has been fixed in SVN.

In case this was a documentation problem, the fix will show up at the
end of next Sunday (CET) on pecl.php.net.

In case this was a pecl.php.net website problem, the change will show
up on the website in short time.
 
Thank you for the report, and for helping us make PECL better.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat Dec 21 17:01:58 2024 UTC