Mailing List Archive

Fatal: memory at 0x804a3dc corrupted (underflow=40)
hi,
I'm trying to encrypt some data with RSA using the libgcrypt CVS snapshot.

I'm using Code I extracted and modified from gnupg-1.1.2 to encrypt the data

GCRY_SEXP list,s_pkey,s_data,s_ciph;
GCRY_MPI* pkey=key.pubkey;
GCRY_MPI data,resarr[2];

gcry_mpi_scan(&data,GCRYMPI_FMT_USG,sdata,&ndata);
switch(alg)
{
case GCRY_PK_ELG:
case GCRY_PK_ELG_E:
if(gcry_sexp_build ( &s_pkey, NULL,
"(public-key(elg(p%m)(g%m)(y%m)))",
pkey[0], pkey[1], pkey[2] ))
return -1;
break;
case GCRY_PK_RSA:
if(gcry_sexp_build( &s_pkey, NULL,
"(public-key(rsa(n%m)(e%m)))",
pkey[0] /* n */, pkey[1] /* e */ ))
return -1;
break;
default:
return -1;
}
/* put the data into a simple list */
if ( gcry_sexp_build( &s_data, NULL, "%m", data ) )
return -1;

/* pass it to libgcrypt */
gcry_pk_encrypt( &s_ciph, s_data, s_pkey );
gcry_sexp_release( s_data );
gcry_sexp_release( s_pkey );

/* extract the MPI values */
if(! (list=gcry_sexp_find_token(s_ciph,"a",0)))
return -1;
if(! (resarr[0]=gcry_sexp_nth_mpi(list,1,0)))
return -1;
gcry_sexp_release ( list );

if(alg==GCRY_PK_ELG||alg==GCRY_PK_ELG_E)
{
if(! (list=gcry_sexp_find_token(s_ciph,"b",0)))
return -1;
if(! (resarr[1]=gcry_sexp_nth_mpi(list,1,0)))
return -1;
}
gcry_sexp_release ( list );
gcry_mpi_print(GCRYMPI_FMT_USG,to,&nto,resarr[0]);
return 0;

In the gcry_sexp_release ( list ); function the program exits always with the
error code 02 and this message is printed to stderr

Fatal: memory at 0x804a3dc corrupted (underflow=40)

what is wrong?
Re: Fatal: memory at 0x804a3dc corrupted (underflow=40) [ In reply to ]
On Tue Oct 22 2002; 17:58, Ruediger Sonderfeld wrote:

> /* extract the MPI values */
> if(! (list=gcry_sexp_find_token(s_ciph,"a",0)))
> return -1;
> if(! (resarr[0]=gcry_sexp_nth_mpi(list,1,0)))
> return -1;
>++ gcry_sexp_release ( list );
>
> if(alg==GCRY_PK_ELG||alg==GCRY_PK_ELG_E)
> {
> if(! (list=gcry_sexp_find_token(s_ciph,"b",0)))
> return -1;
> if(! (resarr[1]=gcry_sexp_nth_mpi(list,1,0)))
> return -1;
> }
>** gcry_sexp_release ( list );
> gcry_mpi_print(GCRYMPI_FMT_USG,to,&nto,resarr[0]);
> return 0;
>

Correcte me if I'm wrong but...if you use RSA, the list is released at ++.
Then the next if statement is not used (it's RSA) and then you release
the list *again* at **. I would say this is not right.

Only free the list again, if ELG is used.


Timo
Re: Fatal: memory at 0x804a3dc corrupted (underflow=40) [ In reply to ]
On Tue Oct 22 2002; 21:01, Ruediger Sonderfeld wrote:

> int wcrypt_pkdecrypt(pkalgo algo,const encrypted_data *data,unsigned char*
> to,size_t tn,pkkey key)

[snip]
>
> if(gcry_sexp_build(&s_data,NULL,"(enc-val(rsa(a%m)))",data[0]))
> //<----here the error occures
> return -1;

The SEXP structure expects a MPI (GCRY_MPI=%m) but you use a
const structure (encrypted_data) and this might the problem.

BTW, it's propably the best you use a debugger to take a closer look
at the specific variables and pointers.


Timo
Re: Fatal: memory at 0x804a3dc corrupted (underflow=40) [ In reply to ]
On Tuesday, 22. October 2002 16:31, you wrote:
> Correcte me if I'm wrong but...if you use RSA, the list is released at ++.
> Then the next if statement is not used (it's RSA) and then you release
> the list *again* at **. I would say this is not right.
>
> Only free the list again, if ELG is used.

Oh I'm an idiot. Thanks for your help.

But now I have another problem. I want to decrypt some data with RSA I use a
function which I extracted and modified from gnupg-1.1.2 too

But now I recive this error and the program recives a SIGABRT

Fatal error: out of core in secure memory

What is now wrong?

(encrypted_data is a typedef for MPI and pkkey is the structur
typedef struct
{
pk_key *pubkey; //public key
pk_key *prikey; //private key
} pkkey;
)

int wcrypt_pkdecrypt(pkalgo algo,const encrypted_data *data,unsigned char*
to,size_t tn,pkkey key)
{
GCRY_SEXP s_skey,s_data,s_plain;
int rc;
MPI *result=NULL,*skey=key.prikey;

switch(algo)
{
case GCRY_PK_ELG:
case GCRY_PK_ELG_E:
/* make a sexp from skey */
if(gcry_sexp_build(&s_skey,NULL,
"(private-key(elg(p%m)(g%m)(y%m)(x%m)))",
skey[0], skey[1], skey[2], skey[3]))
return -1;
/* put data into a S-Exp s_data */

if(gcry_sexp_build(&s_data,NULL,"(enc-val(elg(a%m)(b%m)))",data[0],data[1]))
return -1;
break;
case GCRY_PK_RSA:
/* make a sexp from skey */
if(gcry_sexp_build(&s_skey,NULL,
"(private-key(rsa(n%m)(e%m)(d%m)(p%m)(q%m)(u%m)))",
skey[0], skey[1], skey[2], skey[3], skey[4], skey[5]))
/* put data into a S-Exp s_data */ return -1;

if(gcry_sexp_build(&s_data,NULL,"(enc-val(rsa(a%m)))",data[0]))
//<----here the error occures
return -1;
break;
default:
return -1;
}

rc=gcry_pk_decrypt(&s_plain,s_data,s_skey);
gcry_sexp_release(s_skey);
gcry_sexp_release(s_data);
if(rc)
return rc;

if(! (*result=gcry_sexp_nth_mpi(s_plain,0,0)))
{
gcry_sexp_release(s_plain);
return -1;
}

gcry_mpi_print(GCRYMPI_FMT_USG,to,&tn,*result);
gcry_sexp_release(s_plain);
return 0;
}
Re: Fatal: memory at 0x804a3dc corrupted (underflow=40) [ In reply to ]
On Tuesday, 22. October 2002 19:27, you wrote:
> The SEXP structure expects a MPI (GCRY_MPI=%m) but you use a
> const structure (encrypted_data) and this might the problem.

Oh sorry, this was only a C&P Failure. The problem occures in the
gcry_pk_decrypt function.

> BTW, it's propably the best you use a debugger to take a closer look
> at the specific variables and pointers.

I'm using a Debugger. But I didn't found anything going wrong :(