nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-13 06:33:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/maint-0.2.2'

Browse Source
This commit is contained in:
Nick Mathewson 2011-11-07 10:44:02 -05:00
commit 51f53b590e
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
changes/bug4410 Normal file
View File

@ -0,0 +1,5 @@
o Major bugfixes:
- Correctly sanity-check that we don't underflow on a memory allocation
for introduction point decryption. Bug discovered by Dan Rosenberg.
Fixes bug 4410; bugfix on 0.2.1.5-alpha.

5
src/or/routerparse.c
View File

@ -4886,6 +4886,11 @@ rend_decrypt_introduction_points(char **ipos_decrypted,
crypto_cipher_env_t *cipher; crypto_cipher_env_t *cipher;
char *dec; char *dec;
int declen; int declen;
if (ipos_encrypted_size < CIPHER_IV_LEN + 2) {
log_warn(LD_REND, "Size of encrypted introduction points is too "
"small.");
return -1;
}
dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1); dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1);
cipher = crypto_create_init_cipher(descriptor_cookie, 0); cipher = crypto_create_init_cipher(descriptor_cookie, 0);
declen = crypto_cipher_decrypt_with_iv(cipher, dec, declen = crypto_cipher_decrypt_with_iv(cipher, dec,