Created attachment 912217 [details] Patch fixing the overflow

Description of problem: A bug in GPGME crashes my KMail reproducibly when opening the private key selection dialog twice in a row.

The crash is due to an overflow of the gpgsm->colon.attic.line buffer within statushandler() in engine-gpgsm.c. This buffer is getting (re)allocated at line 831 like this:

if (gpgsm->colon.attic.linesize < alinelen + linelen + 1) { char newline = realloc (aline, alinelen + linelen + 1); gpgsm->colon.attic.linesize += linelen + 1; ...

So in other words, the code allocates a buffer to be alinelen + linelen + 1 bytes long, but then thinks its capacity is actually linesize + linelen + 1. This assumption is wrong if alinelen (the number of bytes used in the buffer prior to reallocation) is lower than linesize (the total length of the buffer), or in other words, if the buffer is not completely full.

In that case, a fragment of the input line is subsequently written past the end of the buffer at line 856:

dst = src++;

I'm not sure if it is really exploitable, but in general this routine is processing arbitrary data coming from certificates the user happens to encounter somehow, so one could possibly exploit this using specially crafted certificate or something like that.

Attached is a trivial patch fixing the issue (works fine for me during daily use of KMail with e-mail signing/encryption).

Version-Release number of selected component (if applicable): gpgme-1.3.2-4.fc20.x8664

How reproducible: Perfectly reproducible for me, but as the bug is data-dependent and I'm not going to publish my keys, I don't have a simple testcase. (I don't think it matters at all as the bug is quite obvious just from the source.)