From 2f05fc96b1332caf97176841b1152da3f0aa16a8 Mon Sep 17 00:00:00 2001 From: Hitendra Prajapati Date: Fri, 22 Jul 2022 17:52:36 +0530 Subject: [PATCH] CVE-2022-34903 Upstream-Status: Backport [https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=34c649b3601383cd11dbc76221747ec16fd68e1b] CVE: CVE-2022-34903 Signed-off-by: Hitendra Prajapati --- g10/cpr.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/g10/cpr.c b/g10/cpr.c index d502e8b..bc4b715 100644 --- a/g10/cpr.c +++ b/g10/cpr.c @@ -328,20 +328,15 @@ write_status_text_and_buffer (int no, const char *string, } first = 0; } - for (esc=0, s=buffer, n=len; n && !esc; s++, n--) + for (esc=0, s=buffer, n=len; n; s++, n--) { if (*s == '%' || *(const byte*)s <= lower_limit || *(const byte*)s == 127 ) esc = 1; if (wrap && ++count > wrap) - { - dowrap=1; - break; - } - } - if (esc) - { - s--; n++; + dowrap=1; + if (esc || dowrap) + break; } if (s != buffer) es_fwrite (buffer, s-buffer, 1, statusfp); -- 2.25.1