Project

General

Profile

Bug #288

PGP signature not verified properly when the message has no newline at the end.

Added by Simeon Simeonov almost 5 years ago. Updated 9 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Security
Target version:
Start date:
01/28/2018
Due date:
% Done:

0%

Estimated time:

Description

Sylpheed marks emails with valid signatures as having a bad signature, when
the email doesn't contain (is not composed with) any trailing newline (examples attached).

RFC-2440 section-7.1 states:
"...The line ending (i.e. the <CR><LF>) before the '-----BEGIN PGP SIGNATURE-----' line that terminates the signed text is not considered part of the signed text..."

libsylph/utils.c:3265 contains the block:
if (last_linebreak TRUE) {
if (fputs("\r\n", dest_fp) EOF)
err = TRUE;
}

The signature checking seems to work properly when removing it.

The reason I am not submitting a patch is that canonicalize_file is used and perhaps needed in this form by other part of Sylpheed.


Files

bad_signature.txt (5.36 KB) bad_signature.txt Email with good signature that is marked as having bad signature Simeon Simeonov, 01/28/2018 10:18 PM
good_signature.txt (5.37 KB) good_signature.txt Email that is verified properly Simeon Simeonov, 01/28/2018 10:18 PM
#1

Updated by replica watches 9 months ago

https://www.bestwatchaaa.com/Hamilton-replica.html https://www.bestwatchaaa.com/Ebel-replica.html Watches Mont https://www.replicawatchsshop.cc/Dior-Replica.html Mont https://www.bestwatchaaa.com/Bell-Ross-replica.html https://www.allwatchesen.com/ https://www.hotwatchsreplica.com/Graham.html https://www.replicawatchsshop.cc/Bell-Ross-Replica.html hottest https://www.bestwatchss.com/Patek-Philippe-Replica-Watches.html https://www.watchrm.com/ https://www.replicawatchsshop.cc/Audemars-Piguet-Replica.html https://www.bestwatchss.com/Tudor-Replica-Watches.html https://www.bestwatchaaa.com/IWC-replica.html https://www.bestwatchaaa.com/Breitling-replica.html https://www.hotwatchsreplica.com/Bell-Ross.html https://www.replicawatchsshop.cc/Piaget-Replica.html https://www.allshopwatch.com/ https://www.fakeswatchs.com/ https://www.replicawatchsshop.cc/Zenith-Replica.html https://www.bestwatchaaa.com/Raymond-Weil-replica.html https://www.bestwatchaaa.com/Panerai-replica.html https://www.bestwatchaaa.com/Cartier-replica.html https://www.hotwatchsreplica.com/porsche-design.html the wholesale price https://www.bestwatchss.com/ the lowest https://www.hotwatchsreplica.com/ https://www.bestwatchaaa.com/Rolex-replica.html the https://www.bestwatchaaa.com/Breguet-replica.html And https://www.bestwatchaaa.com/Technomarine-replica.html https://www.bestwatchss.com/Nomos-Replica-Watches.html https://www.bestwatchss.com/Corum-Replica-Watches.html https://www.bestwatchaaa.com/U-Boat-replica.html https://www.bestwatchaaa.com/Rado-replica.html https://www.replicawatchsshop.cc/Maurice-Lacroix-Replica.html https://www.bestwatchaaa.com/Glashutte-Original-replica.html https://www.bestwatchss.com/Porsche-Design-Replica-Watches.html https://www.replicawatchsshop.cc/Rado-Replica.html ones.

Also available in: Atom PDF