changeset: 6384:5a86319adad0
user:      Kevin McCarthy <ke...@8t8.us>
date:      Mon Jan 05 18:28:59 2015 -0800
link:      http://dev.mutt.org/hg/mutt/rev/5a86319adad0

Fix segv in pgp_getkeybystr().  (closes #3725)

When searching for keys, and the user supplies "" to match against,
pgp_getkeybystr will have values:
  p = "";
  l = 0;
After returning from pgp_select_key(), it will try to assign to
p[l-1].

(As a note, the function is chopping off and restoring the trailing
"!" character because of ticket #1928.)

diffs (19 lines):

diff -r 1b583341d5ad -r 5a86319adad0 pgpkey.c
--- a/pgpkey.c  Sun Sep 07 11:04:54 2014 -0700
+++ b/pgpkey.c  Mon Jan 05 18:28:59 2015 -0800
@@ -985,13 +985,13 @@
       pgp_remove_key (&matches, k);
 
     pgp_free_key (&matches);
-    if (!p[l-1])
+    if (l && !p[l-1])
       p[l-1] = '!';
     return k;
   }
 
 out:
-  if (!p[l-1])
+  if (l && !p[l-1])
     p[l-1] = '!';
   return NULL;
 }

Reply via email to