1679756 - Thunderbird OpenPGP passes truncated data block to RNP when verifying UTF-8 clear signed text

Status: RESOLVED FIXED

(MailNews Core :: Security: OpenPGP, defect, P1)

Description

[Kai Engert (:KaiE:)]

If we're processing a message that contains UTF-8 data, our conversion code from JS strings to ctypes data buffers is incorrect.

The conversion incorrectly uses the character length of the JS string, instead of the length after converting an UTF-8 string to a byte buffer.

Consequently a short data buffer is given to RNP, and the processing fails.

Comment 1

[Kai Engert (:KaiE:)]

Attachment: Bug 1679756 - Truncated data block passed to RNP when verifying UTF-8 clear signed text. r=mkmelin

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/3b35e465086d
Truncated data block passed to RNP when verifying UTF-8 clear signed text. r=mkmelin

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/31da0d03aa5f
followup - fix linting. rs=eslint DONTBUILD

Comment 4

[Kai Engert (:KaiE:)]

Comment on attachment 9190272 [details]
Bug 1679756 - Truncated data block passed to RNP when verifying UTF-8 clear signed text. r=mkmelin

[Approval Request Comment]
Regression caused by (bug #): no
User impact if declined: many OpenPGP messages shown with incorrect message status
Testing completed (on c-c, etc.):
Risk to taking this patch (and alternatives if risky): low

Comment 5

[Wayne Mery (:wsmwk)]

Comment on attachment 9190272 [details]
Bug 1679756 - Truncated data block passed to RNP when verifying UTF-8 clear signed text. r=mkmelin

[Triage Comment]
This won't reach beta via uplift, unfortunately.
Approved for esr78

Comment 6

[Kai Engert (:KaiE:)]

78.6.0
https://hg.mozilla.org/releases/comm-esr78/rev/b5f4bc21540aef464d6f528283361c02e7c82f1a