nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 13:13:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'public/bug15821_025'

Browse Source
This commit is contained in:
Nick Mathewson 2015-05-05 15:06:57 -04:00
commit b0ea36d779
2 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/bug15823 Normal file
View File

@ -0,0 +1,4 @@
o Minor bugfixes (hidden service):
- Fix an out-of-bounds read when parsing invalid INTRODUCE2 cells
on a client authorized hidden service. Fixes bug 15823; bugfix
on 0.2.1.6-alpha.

18
src/or/rendservice.c
View File

@ -1310,11 +1310,13 @@ rend_service_requires_uptime(rend_service_t *service)
return 0; return 0;
} }
/** Check client authorization of a given <b>descriptor_cookie</b> for /** Check client authorization of a given <b>descriptor_cookie</b> of
* <b>service</b>. Return 1 for success and 0 for failure. */ * length <b>cookie_len</b> for <b>service</b>. Return 1 for success
* and 0 for failure. */
static int static int
rend_check_authorization(rend_service_t *service, rend_check_authorization(rend_service_t *service,
const char *descriptor_cookie) const char *descriptor_cookie,
size_t cookie_len)
{ {
rend_authorized_client_t *auth_client = NULL; rend_authorized_client_t *auth_client = NULL;
tor_assert(service); tor_assert(service);
@ -1325,6 +1327,13 @@ rend_check_authorization(rend_service_t *service,
return 0; return 0;
} }
if (cookie_len != REND_DESC_COOKIE_LEN) {
log_info(LD_REND, "Descriptor cookie is %lu bytes, but we expected "
"%lu bytes. Dropping cell.",
(unsigned long)cookie_len, (unsigned long)REND_DESC_COOKIE_LEN);
return 0;
}
/* Look up client authorization by descriptor cookie. */ /* Look up client authorization by descriptor cookie. */
SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, client, { SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, client, {
if (tor_memeq(client->descriptor_cookie, descriptor_cookie, if (tor_memeq(client->descriptor_cookie, descriptor_cookie,
@ -1672,7 +1681,8 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request,
if (service->clients) { if (service->clients) {
if (parsed_req->version == 3 && parsed_req->u.v3.auth_len > 0) { if (parsed_req->version == 3 && parsed_req->u.v3.auth_len > 0) {
if (rend_check_authorization(service, if (rend_check_authorization(service,
(const char*)parsed_req->u.v3.auth_data)) { (const char*)parsed_req->u.v3.auth_data,
parsed_req->u.v3.auth_len)) {
log_info(LD_REND, "Authorization data in INTRODUCE2 cell are valid."); log_info(LD_REND, "Authorization data in INTRODUCE2 cell are valid.");
} else { } else {
log_info(LD_REND, "The authorization data that are contained in " log_info(LD_REND, "The authorization data that are contained in "