🚀 go-pugleaf

In article <1992Sep12.174358.11564@colnet.cmhnet.org> res@colnet.cmhnet.org (Rob Stampfli) writes:
>I recently had a chance to play around with pgp2.0 on a sVr2 Unix machine.
>There appears to be a big security problem with the signature mechanism:
>If you "sign" a file, and then add additional information to the end of
>the signed file, pgp includes this additional information as part of what
>it says you signed.  For instance:
>
>echo 1 2 3 4 5 | pgp -fs >xyzzy.pgp
>echo 6 7 8 9 10 >>xyzzy.pgp
>pgp xyzzy.pgp
>
>pgp now tells me I have signed the phrase:
>
>	1 2 3 4 5
>	6 7 8 9 10
>
>when I have in fact only signed the first line.
>-- 
>Rob Stampfli  rob@colnet.cmhnet.org      The neat thing about standards:
>614-864-9377  HAM RADIO: kd8wk@n8jyv.oh  There are so many to choose from.

The following may be a fix. I haven't tested it extensively, it may
very well screw something else up.

Mark

*** crypto.c.orig	Mon Sep 14 10:31:12 1992
--- crypto.c	Mon Sep 14 10:31:48 1992
***************
*** 1494,1505 ****
  		}
  		CONVERSION = (lit_mode == MODE_TEXT) ? EXT_CONV : NO_CONV;
  #ifdef CANONICAL_TEXT
! 		copyfile(f,g,-1L);	/* copy rest of file from file f to g */
  #else
  		if (lit_mode == MODE_BINARY)
! 			copyfile( f, g, -1L );
  		else
! 			copyfile_from_canon( f, g, -1L );
  #endif
  		CONVERSION = NO_CONV;
  
--- 1494,1505 ----
  		}
  		CONVERSION = (lit_mode == MODE_TEXT) ? EXT_CONV : NO_CONV;
  #ifdef CANONICAL_TEXT
! 		copyfile(f,g,text_len);	/* copy rest of file from file f to g */
  #else
  		if (lit_mode == MODE_BINARY)
! 			copyfile( f, g, text_len );
  		else
! 			copyfile_from_canon( f, g, text_len );
  #endif
  		CONVERSION = NO_CONV;