nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 21:23:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'maint-0.3.2' into maint-0.3.3

Browse Source
This commit is contained in:
Nick Mathewson 2018-06-08 10:11:57 -04:00
commit c27bb4072c
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/bug26196 Normal file
View File

@ -0,0 +1,4 @@
o Minor bugfixes (hardening):
- Prevent a possible out-of-bounds smartlist read in
protover_compute_vote(). Fixes bug 26196; bugfix on
0.2.9.4-alpha.

13
src/or/protover.c
View File

@ -529,6 +529,10 @@ cmp_single_ent_by_version(const void **a_, const void **b_)
static char *
contract_protocol_list(const smartlist_t *proto_strings)
{
if (smartlist_len(proto_strings) == 0) {
return tor_strdup("");
}
// map from name to list of single-version entries
strmap_t *entry_lists_by_name = strmap_new();
// list of protocol names
@ -637,6 +641,10 @@ char *
protover_compute_vote(const smartlist_t *list_of_proto_strings,
int threshold)
{
if (smartlist_len(list_of_proto_strings) == 0) {
return tor_strdup("");
}
smartlist_t *all_entries = smartlist_new();
// First, parse the inputs and break them into singleton entries.
@ -663,6 +671,11 @@ protover_compute_vote(const smartlist_t *list_of_proto_strings,
smartlist_free(unexpanded);
} SMARTLIST_FOREACH_END(vote);
if (smartlist_len(all_entries) == 0) {
smartlist_free(all_entries);
return tor_strdup("");
}
// Now sort the singleton entries
smartlist_sort_strings(all_entries);