Re: Retrospective by 'gpg.fail' authors

[Werner Koch <wk () gnupg org>]

On Wed, 16 Sep 2026 02:27, Sam James said:
> Werner Koch <wk () gnupg org> writes:
>
> > Hi!
>
> Thank you Werner!
>
> > On Mon, 14 Sep 2026 21:28, Clemens Lang said:
> >
> > > (1) A RCE in `gpgsm` 2.4.9 when invoked as `gpgsm --debug all --import
> > > bad.cert`, with the bad.cert file at [1]. This is apparently a 0-day,
> >
> > Actually in all versions > 2.2 if you use --debug x509.  The result is
> > that you get garbled output on stderr.  Using the certificates from
> > their Git repo we have not been able to get more than a segv.  That is
> > obvious because the DER is used as printf format string.  How it is
> > possible to get a an RCE is not clear to me - at least not with the
> > sample certificate.  We need a real reproducers.  Maybe the presentation
> > used a custom build.  It uses libgcrypt 1.12.4 which is not yet used in
> > any binary we released.
> >
> > This is the fix:
> >
> >                if (DBG_X509)
> > -                log_debug(skider, skiderlen, "ski is:");
> > +                log_printhex (skider, skiderlen, "ski is:");
> >
> > We did not used -Wformat-nonliteral which would have caught it due to
> > gcc problems and distros requiring -Werror.
>
> You should feel free these days to use whatever -W* you want/need to. No
> distros should be using -Werror without at least being willing to

Yes, sure.  But 2003 was a different time and that part of the code was
simply forgotten:

  commit 8ab35a7d26707dfa0032b3b0dbde6a984a9683cb
  Author:     Werner Koch <wk () gnupg org>
  AuthorDate: Wed Dec 17 12:26:38 2003 +0000

    * gettime.c (asctimestamp): Add a note on a non-avoidable gcc warning.
    
    * util.h [!HAVE_VASPRINTF]: Add printf format attribute to the
    replacement function.


The more interesting thing is that no source code scanning or AI found
the really obvious bug introduced 6 years ago:

  commit b1694987bb6484405d41d34046a5290176feadd0
  Author:     Werner Koch <wk () gnupg org>
  AuthorDate: Wed May 13 21:21:24 2020 +0200

    sm: Support import and verification of EdDSA certificates.
    
    * sm/certdump.c (gpgsm_get_serial): New.
    * sm/certcheck.c (gpgsm_check_cert_sig): Support EdDSA signatures.


Salam-Shalom,

   Werner

-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein

Attachment: openpgp-digital-signature.asc
Description: