11aa379e35
* bugfix: duplicate command-line arguments [7dfdb3c] * Add minisign-dup-command-line-args.patch - Security fix: [gpg.fail/trustcomment] * Trusted comment injection (minisign) [6c59875] * trim(): only trim trailing \r\n, reject straight \r characters * Add minisign-gpg.fail-trustcomment.patch - Security fix: [gpg.fail/minisign] * Trusted comment injection (minisign) [a10dc92] * Bail out if the signature file contains unprintable characters * Add minisign-gpg.fail-minisign.patch OBS-URL: https://build.opensuse.org/package/show/security/minisign?expand=0&rev=8
48 lines
1.1 KiB
Diff
48 lines
1.1 KiB
Diff
From a10dc92b69cd549de8b691fdc32df866de9bd739 Mon Sep 17 00:00:00 2001
|
|
From: Frank Denis <github@pureftpd.org>
|
|
Date: Mon, 29 Dec 2025 23:00:30 +0100
|
|
Subject: [PATCH] trim(): only trim trailing \r\n, reject straight \r
|
|
characters
|
|
|
|
Spotted by @two-heart, thanks!
|
|
---
|
|
src/helpers.c | 25 +++++++++++++++----------
|
|
1 file changed, 15 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/src/helpers.c b/src/helpers.c
|
|
index 9598b4e..4b8994f 100644
|
|
--- a/src/helpers.c
|
|
+++ b/src/helpers.c
|
|
@@ -158,16 +158,21 @@ xfclose(FILE *fp)
|
|
int
|
|
trim(char *str)
|
|
{
|
|
- size_t i = strlen(str);
|
|
- int t = 0;
|
|
-
|
|
- while (i-- > (size_t) 0U) {
|
|
- if (str[i] == '\n') {
|
|
- str[i] = 0;
|
|
- t = 1;
|
|
- } else if (str[i] == '\r') {
|
|
- str[i] = 0;
|
|
- }
|
|
+ size_t len = strlen(str);
|
|
+ int t = 0;
|
|
+
|
|
+ if (len == 0U) {
|
|
+ return 0;
|
|
+ }
|
|
+ if (str[len - 1U] == '\n') {
|
|
+ str[--len] = 0;
|
|
+ t = 1;
|
|
+ }
|
|
+ if (len > 0U && str[len - 1U] == '\r') {
|
|
+ str[--len] = 0;
|
|
+ }
|
|
+ if (memchr(str, '\r', len) != NULL) {
|
|
+ return 0;
|
|
}
|
|
return t;
|
|
}
|