From 402907286f191a57199230c2e785eeaa7751acb2 Mon Sep 17 00:00:00 2001 From: brainx <12695242+brainx@users.noreply.github.com> Date: Wed, 17 Jun 2026 14:56:22 +0000 Subject: [PATCH 1/3] Fix out-of-bounds length in pgp_3desdecrypt MDC path The 3DES decrypt passed in->length - 10 + mdc as the ciphertext body length, reading and writing 2 bytes past the intended region when mdc=1 (OpenPGP MDC packets). Every sibling cipher (IDEA, CAST5, Blowfish, AES) uses - mdc, and the MDC ciphertext layout produced by pgp_3desencrypt makes - mdc the correct length. Mitigated in practice by buffer slack, but a genuine out-of-bounds access. Co-authored-by: BrainX --- Src/pgpget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Src/pgpget.c b/Src/pgpget.c index 9ec05f8..3efa74e 100644 --- a/Src/pgpget.c +++ b/Src/pgpget.c @@ -442,7 +442,7 @@ static int pgp_3desdecrypt(BUFFER *in, BUFFER *out, BUFFER *key, int mdc) memcpy(iv, in->data + 2, 6); n = 0; } - des_ede3_cfb64_encrypt(in->data + 10 + mdc, out->data, in->length - 10 + mdc, &ks1, + des_ede3_cfb64_encrypt(in->data + 10 + mdc, out->data, in->length - 10 - mdc, &ks1, &ks2, &ks3, &iv, &n, DECRYPT); if (mdc) { if (out->length > 22) { From a643a220fffb4e7d18e0c52e642e52620f03bbda Mon Sep 17 00:00:00 2001 From: brainx <12695242+brainx@users.noreply.github.com> Date: Wed, 17 Jun 2026 14:56:22 +0000 Subject: [PATCH 2/3] Fix format-string usage flagged by -Wformat-security fprintf(mbox, line) in logmail() and printw(ALLPINGERSURL) in the stats menu passed runtime/config-derived strings as format strings. Pass them as %s arguments instead. Co-authored-by: BrainX --- Src/menustats.c | 2 +- Src/rem.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Src/menustats.c b/Src/menustats.c index 6437847..81f9ad1 100644 --- a/Src/menustats.c +++ b/Src/menustats.c @@ -290,7 +290,7 @@ static int download_list() { clear(); standout(); - printw(ALLPINGERSURL); + printw("%s", ALLPINGERSURL); standend(); mvprintw(3,0,"downloading %s...", ALLPINGERSURL); diff --git a/Src/rem.c b/Src/rem.c index a2b4675..62fdd47 100644 --- a/Src/rem.c +++ b/Src/rem.c @@ -191,7 +191,7 @@ void logmail(char *mailbox, BUFFER *message) t = time(NULL); tc = localtime(&t); strftime(line, LINELEN, "From Mixmaster %a %b %d %H:%M:%S %Y\n", tc); - fprintf(mbox, line); + fprintf(mbox, "%s", line); } buf_write(message, mbox); fprintf(mbox, "\n\n"); From 1d8b0f2cc2095da01064dd53c45702f34c9e95d1 Mon Sep 17 00:00:00 2001 From: brainx <12695242+brainx@users.noreply.github.com> Date: Wed, 17 Jun 2026 14:56:22 +0000 Subject: [PATCH 3/3] Add missing include to date-parse test test-parse_yearmonthday.c calls memset() without including , which fails to compile as an error under modern clang/gcc. Co-authored-by: BrainX --- Src/tests/test-parse_yearmonthday.c | 1 + 1 file changed, 1 insertion(+) diff --git a/Src/tests/test-parse_yearmonthday.c b/Src/tests/test-parse_yearmonthday.c index 7e7cfe4..ca6dff4 100644 --- a/Src/tests/test-parse_yearmonthday.c +++ b/Src/tests/test-parse_yearmonthday.c @@ -1,5 +1,6 @@ #include #include +#include #include #define LINELEN 128