| commit | 24ffb5feb3312a39054178a4b0a4554fc2201248 | [log] [tgz] |
|---|---|---|
| author | KB Sriram <kbsriram@google.com> | Wed May 06 21:55:27 2015 -0700 |
| committer | Adam Langley <agl@golang.org> | Fri May 08 01:16:24 2015 +0000 |
| tree | b5abd0276b987616b29b1093861cb410273bf996 | |
| parent | 59435533c88bd0b1254c738244da1fe96b59d05d [diff] |
x/crypto/openpgp: Limit packet recursion depth. A carefully crafted packet can cause the packet reader to push an infinite number of recursive packet readers. This change limits the number of recursive parsing levels within the packet reader. More details at: http://mumble.net/~campbell/misc/pgp-quine https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4402 Fixes #10751 Change-Id: Ib4e102d85f6496e2c7feb5b9d7e5db45db6032df Reviewed-on: https://go-review.googlesource.com/9843 Reviewed-by: Adam Langley <agl@golang.org>