Mailing List Archive: Bug in g10/build-packet.c:gpg_mpi

Hi,

I think there is a bug in GnuPG the function
g10/build-packet.c:gpg_mpi_write()

The case I observed is an opaque MPI with a leading byte 0x04. The call
to gcry_mpi_get_opaque() already sets the correct bit length (i.e.
accounting for the highest 5 bits to be zero). Then the subsequent code
again subtracts 5 from nbits, effectively reducing the byte count by
one. The written MPI is thus one byte too short.

- Falko

gpg_error_t
gpg_mpi_write (iobuf_t out, gcry_mpi_t a, unsigned int *r_nwritten)
{
gpg_error_t err;
unsigned int nwritten = 0;

if (gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
    {
      unsigned int nbits;
      const unsigned char *p;
      unsigned char lenhdr[2];

      /* gcry_log_debugmpi ("a", a); */
      p = gcry_mpi_get_opaque (a, &nbits);
      if (p)
        {
          /* Strip leading zero bits. */
          for (; nbits >= 8 && !*p; p++, nbits -= 8)
            ;
          if (nbits >= 8 && !(*p & 0x80))
            if (--nbits >= 7 && !(*p & 0x40))
              if (--nbits >= 6 && !(*p & 0x20))
                if (--nbits >= 5 && !(*p & 0x10))
                  if (--nbits >= 4 && !(*p & 0x08))
                    if (--nbits >= 3 && !(*p & 0x04))
                      if (--nbits >= 2 && !(*p & 0x02))
                        if (--nbits >= 1 && !(*p & 0x01))
                          --nbits;

--

*MTG AG*
Dr. Falko Strenzke
Executive System Architect

Phone: +49 6151 8000 24
E-Mail: falko.strenzke@mtg.de
Web: mtg.de <https://www.mtg.de>

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised
copying or distribution of this email is not permitted.

Data protection information: Privacy policy
<https://www.mtg.de/en/privacy-policy>

Hi!

> call to gcry_mpi_get_opaque() already sets the correct bit length
> (i.e. accounting for the highest 5 bits to be zero). Then the
> subsequent code again subtracts 5 from nbits, effectively reducing the

Good catch and my fault from 2015. That code is not anymore used
because we switched to sos_write for ECC parameters in 2020.

However, in theory GnuPG versions 2.1.5 to 2.2.20 may have produced
produced incorrect MPIs when writing ECC parameters.

Fortunately the mpi read function has always rounded up to full bytes,
the gcry_sexp_nth_mpi, used to parse the s-expressions, either produced
a plain MPI or when requested to create an opaque MPI, the bit value was
also rounded up to full bytes.

> byte count by one. The written MPI is thus one byte too short.

I am pretty sure this would have been noticed ;-)

Fixed with:
https://dev.gnupg.org/rG2372f6a4035cefd5ac1852e95dc50de89cc73af6

Shalom-Salam,

Werner

--
The pioneers of a warless world are the youth that
refuse military service. - A. Einstein

Mailing List Archive

Attached Files:

Attached Files: