From f54bb8daab9190b951d9b48f932e40fc3151d0e2 Mon Sep 17 00:00:00 2001
From: Filippo Valsorda <hi@filippo.io>
Date: Wed, 25 Mar 2020 00:25:17 -0400
Subject: [PATCH] internal/format: don't generate and reject empty lines in
 recipient bodies

Detected by https://github.com/str4d/rage/runs/532262359 and by go-fuzz.
---
 cmd/age/age_test.go                           |  47 ++++++++++++++++++
 cmd/age/testdata/empty_recipient_body.age     | Bin 0 -> 240 bytes
 cmd/age/testdata/empty_recipient_body_key.txt |   7 +++
 internal/format/format.go                     |   6 +++
 4 files changed, 60 insertions(+)
 create mode 100644 cmd/age/age_test.go
 create mode 100644 cmd/age/testdata/empty_recipient_body.age
 create mode 100644 cmd/age/testdata/empty_recipient_body_key.txt

diff --git a/cmd/age/age_test.go b/cmd/age/age_test.go
new file mode 100644
index 0000000..8799887
--- /dev/null
+++ b/cmd/age/age_test.go
@@ -0,0 +1,47 @@
+// Copyright 2019 Google LLC
+//
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file or at
+// https://developers.google.com/open-source/licenses/bsd
+
+package main
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"filippo.io/age/internal/age"
+)
+
+func TestVectors(t *testing.T) {
+	files, _ := filepath.Glob("testdata/*.age")
+	for _, f := range files {
+		name := strings.TrimSuffix(strings.TrimPrefix(f, "testdata/"), ".age")
+		t.Run(name, func(t *testing.T) {
+			identities, err := parseIdentitiesFile("testdata/" + name + "_key.txt")
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, i := range identities {
+				t.Logf("%s", i.Type())
+			}
+
+			in, err := os.Open("testdata/" + name + ".age")
+			if err != nil {
+				t.Fatal(err)
+			}
+			r, err := age.Decrypt(in, identities...)
+			if err != nil {
+				t.Fatal(err)
+			}
+			out, err := ioutil.ReadAll(r)
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Logf("%s", out)
+		})
+	}
+}
diff --git a/cmd/age/testdata/empty_recipient_body.age b/cmd/age/testdata/empty_recipient_body.age
new file mode 100644
index 0000000000000000000000000000000000000000..55769e954c9541a8b929d5922bdde63bffea0d13
GIT binary patch
literal 240
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7H}oh?NmmGt@(j-Q
zG!4wNh)fT4$_?>$*N-aD4=ixYiU==r%q*)abJEW6Pxdnnx8O>NOe=Q}k1TU8F9;4b
zb&c?JHjF4ti%2PUDs#>>&i1V=NGWs<3(hDi$OhS#m7kecqMM(YqnlCArK_u}knXH+
zWFF?2Ug+;y<rwJe?NR2Gm6>5)>}8nm;+;{V?ctY_UK-+=lvQHEmG-*CF?H*;6>1jM
nr(b?Jw^uwlv1GdR+jC+w=ByW<C31RuEuZ*m+gZ+S^My+R<K|V(

literal 0
HcmV?d00001

diff --git a/cmd/age/testdata/empty_recipient_body_key.txt b/cmd/age/testdata/empty_recipient_body_key.txt
new file mode 100644
index 0000000..a91b78c
--- /dev/null
+++ b/cmd/age/testdata/empty_recipient_body_key.txt
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACAwKgrb/LkvtI887QylSoUh5xUlKr1fb37euR6et5jHowAAAJgxqUx+MalM
+fgAAAAtzc2gtZWQyNTUxOQAAACAwKgrb/LkvtI887QylSoUh5xUlKr1fb37euR6et5jHow
+AAAEC7gKj74YIwaM1BT2tnODjfeZJvo8lcazvL6Uljv3+nIDAqCtv8uS+0jzztDKVKhSHn
+FSUqvV9vft65Hp63mMejAAAADnJ1bm5lckBmdi1hejMyAQIDBAUGBw==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/internal/format/format.go b/internal/format/format.go
index 0aa60cd..a74e031 100644
--- a/internal/format/format.go
+++ b/internal/format/format.go
@@ -60,6 +60,9 @@ func (r *Recipient) Marshal(w io.Writer) error {
 	if _, err := io.WriteString(w, "\n"); err != nil {
 		return err
 	}
+	if len(r.Body) == 0 {
+		return nil
+	}
 	ww := base64.NewEncoder(b64, &newlineWriter{dst: w})
 	if _, err := ww.Write(r.Body); err != nil {
 		return err
@@ -160,6 +163,9 @@ func Parse(input io.Reader) (*Header, io.Reader, error) {
 			if len(b) > bytesPerLine {
 				return nil, nil, errorf("malformed body line %q: too long", line)
 			}
+			if len(b) == 0 {
+				return nil, nil, errorf("malformed body line %q: line is empty", line)
+			}
 			r.Body = append(r.Body, b...)
 			if len(b) < bytesPerLine {
 				// Only the last line of a body can be short.