Don't panic on corrupt fingerprint subpacket

Author: zugzwang

openpgp/keys_test.go

@@ -1303,3 +1303,16 @@ func TestKeyValidateOnDecrypt(t *testing.T) {
 		t.Fatal("Failed to detect invalid ElGamal key")
 	}
 }
+
+// Should not panic (generated with go-fuzz)
+func TestCorruptKeys(t *testing.T) {
+	data := `-----BEGIN PGP PUBLIC KEY BLOCK00000
+
+mQ00BF00000BCAD0000000000000000000000000000000000000000000000000
+0000000000000000000000000000000000000000000000000000000000000000
+0000000000000000000000000000000000000000000000000000000000000000
+0000000000000000000000000000000000000000000000000000000000000000
+0000000000000000000000000000000000000000000000000000000000000000
+000000000000000000000000000000000000ABE000G0Dn000000000000000000iQ00BB0BAgAGBCG00000`
+	ReadArmoredKeyRing(strings.NewReader(data))
+}

openpgp/packet/signature.go

@@ -418,7 +418,7 @@ func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (r
 		}
 	case issuerFingerprintSubpacket:
 		v, l := subpacket[0], len(subpacket[1:])
-		if v < 5 && l != 20 || v == 5 && l != 32 {
+		if v == 5 && l != 32 || v != 5 && l != 20 {
 			return nil, errors.StructuralError("bad fingerprint length")
 		}
 		sig.IssuerFingerprint = make([]byte, l)