openpgp/packet: reject too-short decrypted session key

EncryptedKey.Decrypt reads the decrypted session key as b[0] (cipher),
b[1:len(b)-2] (key) and b[len(b)-2:] (checksum) without a length check.
A crafted public-key-encrypted message whose RSA, ElGamal or ECDH
ciphertext decrypts to fewer than three octets makes these index and
slice operations panic (index out of range / slice bounds out of
range). This is reachable from ReadMessage when decrypting an
attacker-supplied message, a denial of service for programs that
decrypt untrusted OpenPGP messages.

Reject len(b) < 3 with a StructuralError before indexing.

Author: adilburaksen

openpgp/packet/encrypted_key.go

@@ -94,6 +94,14 @@ func (e *EncryptedKey) Decrypt(priv *PrivateKey, config *Config) error {
 		return err
 	}
 
+	// The decrypted session key is one cipher-algorithm octet, the key
+	// material, and a two-octet checksum. A decryption that yields fewer than
+	// three octets (e.g. from a crafted ElGamal/RSA/ECDH ciphertext) would
+	// otherwise make the indexing below panic with slice/index out of range.
+	if len(b) < 3 {
+		return errors.StructuralError("session key is too short")
+	}
+
 	e.CipherFunc = CipherFunction(b[0])
 	e.Key = b[1 : len(b)-2]
 	expectedChecksum := uint16(b[len(b)-2])<<8 | uint16(b[len(b)-1])