Re: bin/57043: netpgp --help crashes

[Rhialto <rhialto%falu.nl@localhost>]

The following reply was made to PR bin/57043; it has been noted by GNATS.

From: Rhialto <rhialto%falu.nl@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: rhialto%falu.nl@localhost
Subject: Re: bin/57043: netpgp --help crashes
Date: Sun, 2 Oct 2022 23:01:29 +0200

 The quoted source line comes from -current source, not from 9.3.
 This is a bit deceptive...
 
 /usr/src/crypto/external/bsd/netpgp/lib/netpgp/../../dist/src/lib/keyring.c:623 
         623                     EXPAND_ARRAY(key, subsig);                      
 
 I found that 9.3 contains
      $NetBSD: keyring.c,v 1.56 2018/11/13 14:52:30 mlelstv Exp $
 and there is this patch to 1.57:
 http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/external/bsd/netpgp/dist/src/lib/keyring.c.diff?r1=1.56&r2=1.57&only_with_tag=MAIN&f=h
 which inserts that exact line. Without it, no space would be allocated
 for the subsig which is added here.
 
 However I am now wondering why just looking at the crashing key on its
 own did not crash, since the above suggests that the data in the key is
 what triggers the crash: only packets of PGP_PTAG_CT_TRUST would crash.
 
 I tried building a -current version of netpgp (I'm not sure if I did it
 right since it didn't seem to respect my objdirs), and it seems it
 doesn't crash on my keyring. It does however complain a lot like
 
 Can't read pubring /home/rhialto/.gnupg/pubring.gpg
 /mnt/vol1/rhialto/cvs/src/crypto/external/bsd/netpgp/lib/netpgp/../../dist/src/lib/packet-parse.c:2095: PGP_E_ALG_UNSUPPORTED_SIGNATURE_ALG, Bad v4 signature key algorithm (Unknown)
 /mnt/vol1/rhialto/cvs/src/crypto/external/bsd/netpgp/lib/netpgp/../../dist/src/lib/packet-parse.c:1284: PGP_E_ALG_UNSUPPORTED_PUBLIC_KEY_ALG, Unsupported Public Key algorithm (Reserved for Elliptic Curve)
 /mnt/vol1/rhialto/cvs/src/crypto/external/bsd/netpgp/lib/netpgp/../../dist/src/lib/packet-parse.c:1284:
 PGP_E_ALG_UNSUPPORTED_PUBLIC_KEY_ALG, Unsupported Public Key algorithm
 (Unknown)
 ...
 
 It is a bit useless to complain about keys if you don't know which key
 it concerns...