nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-27 22:03:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Stop leaking memory in error cases of md parsing

Browse Source 
When clearing a list of tokens, it's important to do token_clear()
on them first, or else any keys they contain will leak.  This didn't
leak memory on any of the successful microdescriptor parsing paths,
but it does leak on some failing paths when the failure happens
during tokenization.

Fixes bug 11618; bugfix on 0.2.2.6-alpha.
This commit is contained in:
Nick Mathewson 2014-04-26 12:45:34 -04:00
parent ef3d7f2f97
commit 65575b0755
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
changes/md_leak_bug Normal file
View File

@ -0,0 +1,5 @@
o Major bugfixes (security, OOM)
- Fix a memory leak that could occur if a microdescriptor parse
fails during the tokenizing step. This could enable a memory
exhaustion attack by directory servers. Fixes bug #11649; bugfix
on 0.2.2.6-alpha.

2
src/or/routerparse.c
View File

@ -4455,11 +4455,13 @@ microdescs_parse_from_string(const char *s, const char *eos,
microdesc_free(md);
md = NULL;
SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_clear(t));
memarea_clear(area);
smartlist_clear(tokens);
s = start_of_next_microdesc;
}
SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_clear(t));
memarea_drop_all(area);
smartlist_free(tokens);