This issue has been fixed for both GnuPG versions in upstream SVN revision
4993 (1.4) and 4994 (2.x). See https://bugs.g10code.com/gnupg/issue1034.

The patch is attached.

@Thijs: Does this fix/issue qualify for an update of the packages in
        stable/oldstable?

Regards, Daniel
#2009-05-06  Werner Koch  <w...@g10code.com>
#
#	* keyring.c (keyring_get_keyblock): Fix memory leak due to
#	ring_trust packets.  Fixes bug#1034.
#
#	* getkey.c (finish_lookup): Remove dead code.
#
Index: gnupg_1_4/g10/keyring.c
===================================================================
--- gnupg_1_4/g10/keyring.c	(Revision 4992)
+++ gnupg_1_4/g10/keyring.c	(Revision 4993)
@@ -419,38 +419,43 @@
             if ( lastnode 
                  && lastnode->pkt->pkttype == PKT_SIGNATURE
                  && (pkt->pkt.ring_trust->sigcache & 1) ) {
-                /* this is a ring trust packet with a checked signature 
+                /* This is a ring trust packet with a checked signature 
                  * status cache following directly a signature paket.
-                 * Set the cache status into that signature packet */
+                 * Set the cache status into that signature packet.  */
                 PKT_signature *sig = lastnode->pkt->pkt.signature;
                 
                 sig->flags.checked = 1;
                 sig->flags.valid = !!(pkt->pkt.ring_trust->sigcache & 2);
             }
-            /* reset lastnode, so that we set the cache status only from
-             * the ring trust packet immediately folling a signature */
+            /* Reset LASTNODE, so that we set the cache status only
+             * from the ring trust packets immediately following
+             * signature packets.  */
             lastnode = NULL;
+	    free_packet(pkt);
+	    init_packet(pkt);
+            continue;
         }
-        else {
-            node = lastnode = new_kbnode (pkt);
-            if (!keyblock)
-                keyblock = node;
-            else
-                add_kbnode (keyblock, node);
 
-            if ( pkt->pkttype == PKT_PUBLIC_KEY
-                 || pkt->pkttype == PKT_PUBLIC_SUBKEY
-                 || pkt->pkttype == PKT_SECRET_KEY
-                 || pkt->pkttype == PKT_SECRET_SUBKEY) {
-                if (++pk_no == hd->found.pk_no)
-                    node->flag |= 1;
-            }
-            else if ( pkt->pkttype == PKT_USER_ID) {
-                if (++uid_no == hd->found.uid_no)
-                    node->flag |= 2;
-            }
-        }
-
+        node = lastnode = new_kbnode (pkt);
+        if (!keyblock)
+          keyblock = node;
+        else
+          add_kbnode (keyblock, node);
+        
+        if ( pkt->pkttype == PKT_PUBLIC_KEY
+             || pkt->pkttype == PKT_PUBLIC_SUBKEY
+             || pkt->pkttype == PKT_SECRET_KEY
+             || pkt->pkttype == PKT_SECRET_SUBKEY) 
+          {
+            if (++pk_no == hd->found.pk_no)
+              node->flag |= 1;
+          }
+        else if ( pkt->pkttype == PKT_USER_ID) 
+          {
+            if (++uid_no == hd->found.uid_no)
+              node->flag |= 2;
+          }
+        
         pkt = xmalloc (sizeof *pkt);
         init_packet(pkt);
     }

Reply via email to