nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 13:13:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

resolve an edge case in get_unique_circ_id_by_conn

Browse Source 
svn:r944
This commit is contained in:
Roger Dingledine 2003-12-16 20:45:10 +00:00
parent fd37a6fedf
commit 4e50f79b11
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/or/circuit.c
View File

@ -26,7 +26,6 @@ char *circuit_state_to_string[] = {
/********* END VARIABLES ************/
void circuit_add(circuit_t *circ) {
if(!global_circuitlist) { /* first one */
global_circuitlist = circ;
circ->next = NULL;
@ -34,7 +33,6 @@ void circuit_add(circuit_t *circ) {
circ->next = global_circuitlist;
global_circuitlist = circ;
}
}
void circuit_remove(circuit_t *circ) {
@ -126,20 +124,26 @@ static void circuit_free_cpath_node(crypt_path_t *victim) {
/* return 0 if can't get a unique circ_id. */
static circ_id_t get_unique_circ_id_by_conn(connection_t *conn, int circ_id_type) {
circ_id_t test_circ_id;
int attempts=0;
uint16_t high_bit;
assert(conn && conn->type == CONN_TYPE_OR);
assert(conn && conn->type == CONN_TYPE_OR);
high_bit = (circ_id_type == CIRC_ID_TYPE_HIGHER) ? 1<<15 : 0;
do {
/* Sequentially iterate over test_circ_id=1...1<<15-1 until we find an
/* Sequentially iterate over test_circ_id=1...1<<15-1 until we find a
* circID such that (high_bit|test_circ_id) is not already used. */
/* XXX Will loop forever if all circ_id's in our range are used.
* This matters because it's an external DoS vulnerability. */
test_circ_id = conn->next_circ_id++;
if (test_circ_id == 0 || test_circ_id >= 1<<15) {
test_circ_id = 1;
conn->next_circ_id = 2;
}
if(++attempts > 1<<15) {
/* Make sure we don't loop forever if all circ_id's are used. This
* matters because it's an external DoS vulnerability.
*/
log_fn(LOG_WARN,"No unused circ IDs. Failing.");
return 0;
}
test_circ_id |= high_bit;
} while(circuit_get_by_circ_id_conn(test_circ_id, conn));
return test_circ_id;