Git-Mirrors/RetroShare
1
0
Fork 0
mirror of https://github.com/RetroShare/RetroShare.git synced 2024-10-01 02:35:48 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

fixed potential attack by supplying non hexadecimal strings as certificate common name

Browse Source 
git-svn-id: http://svn.code.sf.net/p/retroshare/code/trunk@7048 b45a01b8-16f6-495d-af2f-9b41ad6348cc
This commit is contained in:
csoler 2014-01-21 18:09:05 +00:00
parent 158249d66e
commit 43a32f23e1
1 changed files with 29 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
libretroshare/src/pqi/authgpg.cc
View File

@ -470,29 +470,37 @@ bool AuthGPG::getGPGDetails(const std::string& id, RsPeerDetails &d)
return false ; return false ;
} }
const PGPCertificateInfo *pc = PGPHandler::getCertificateInfo(PGPIdType(id)) ; try
{
const PGPCertificateInfo *pc = PGPHandler::getCertificateInfo(PGPIdType(id)) ;
if(pc == NULL) if(pc == NULL)
return false ;
const PGPCertificateInfo& cert(*pc) ;
d.id = id ;
d.gpg_id = id ;
d.name = cert._name;
d.lastUsed = cert._time_stamp;
d.email = cert._email;
d.trustLvl = cert._trustLvl;
d.validLvl = cert._trustLvl;
d.ownsign = cert._flags & PGPCertificateInfo::PGP_CERTIFICATE_FLAG_HAS_OWN_SIGNATURE;
d.gpgSigners.clear() ;
for(std::set<std::string>::const_iterator it(cert.signers.begin());it!=cert.signers.end();++it)
d.gpgSigners.push_back( *it ) ;
d.fpr = cert._fpr.toStdString();
d.accept_connection = cert._flags & PGPCertificateInfo::PGP_CERTIFICATE_FLAG_ACCEPT_CONNEXION;
d.hasSignedMe = cert._flags & PGPCertificateInfo::PGP_CERTIFICATE_FLAG_HAS_SIGNED_ME;
}
catch(std::exception& e)
{
std::cerr << "(EE) exception raised while constructing a PGP certificate: " << e.what() << std::endl;
return false ; return false ;
}
const PGPCertificateInfo& cert(*pc) ;
d.id = id ;
d.gpg_id = id ;
d.name = cert._name;
d.lastUsed = cert._time_stamp;
d.email = cert._email;
d.trustLvl = cert._trustLvl;
d.validLvl = cert._trustLvl;
d.ownsign = cert._flags & PGPCertificateInfo::PGP_CERTIFICATE_FLAG_HAS_OWN_SIGNATURE;
d.gpgSigners.clear() ;
for(std::set<std::string>::const_iterator it(cert.signers.begin());it!=cert.signers.end();++it)
d.gpgSigners.push_back( *it ) ;
d.fpr = cert._fpr.toStdString();
d.accept_connection = cert._flags & PGPCertificateInfo::PGP_CERTIFICATE_FLAG_ACCEPT_CONNEXION;
d.hasSignedMe = cert._flags & PGPCertificateInfo::PGP_CERTIFICATE_FLAG_HAS_SIGNED_ME;
return true; return true;
} }