Code execution via hash block buffer overflow

Heap buffer overflow in Libgcrypt 1.9.0 allows local users to execute arbitrary code by supplying crafted data for decryption. The _gcry_md_block_write function trusts a large count from the digest final function and writes attacker-controlled data past its heap block buffer. The overflow occurs before signature or verification checks, so processing the input is sufficient to corrupt memory in the calling process.