From a67908ab81151cfd69f71c20cd2975507e0a3b5a Mon Sep 17 00:00:00 2001 From: Justus Winter Date: Mon, 21 Sep 2020 13:19:58 +0200 Subject: openpgp: Refuse to parse ECDH public keys with unknown magic value. - ECDH public fields have a mechanism for future extensions. Currently, this field has to be set to 1. Enforce this at parse time. - Fixes #561. --- openpgp/src/parse/mpis.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'openpgp') diff --git a/openpgp/src/parse/mpis.rs b/openpgp/src/parse/mpis.rs index 9dd7d31a..b1af3c22 100644 --- a/openpgp/src/parse/mpis.rs +++ b/openpgp/src/parse/mpis.rs @@ -118,7 +118,12 @@ impl mpi::PublicKey { "wrong kdf length".into()).into()); } - let _reserved = php.parse_u8("kdf_reserved")?; + let reserved = php.parse_u8("kdf_reserved")?; + if reserved != 1 { + return Err(Error::MalformedPacket( + format!("Reserved kdf field must be 0x01, \ + got 0x{:x}", reserved)).into()); + } let hash: HashAlgorithm = php.parse_u8("kdf_hash")?.into(); let sym: SymmetricAlgorithm = php.parse_u8("kek_symm")?.into(); -- cgit v1.2.3