Merge branch 'bug22672_031' into maint-0.3.1

This commit is contained in:
Nick Mathewson 2017-06-20 20:26:45 -04:00
commit c999e84436
2 changed files with 30 additions and 11 deletions

5
changes/bug22672 Normal file
View File

@ -0,0 +1,5 @@
o Minor features (compression, defensive programming):
- Detect and break out of infinite loops in our compression code.
We don't think that any such loops exist now, but it's best to be
safe. Closes ticket 22672.

View File

@ -548,28 +548,42 @@ tor_compress_process(tor_compress_state_t *state,
int finish) int finish)
{ {
tor_assert(state != NULL); tor_assert(state != NULL);
const size_t in_len_orig = *in_len;
const size_t out_len_orig = *out_len;
tor_compress_output_t rv;
switch (state->method) { switch (state->method) {
case GZIP_METHOD: case GZIP_METHOD:
case ZLIB_METHOD: case ZLIB_METHOD:
return tor_zlib_compress_process(state->u.zlib_state, rv = tor_zlib_compress_process(state->u.zlib_state,
out, out_len, in, in_len, out, out_len, in, in_len,
finish); finish);
break;
case LZMA_METHOD: case LZMA_METHOD:
return tor_lzma_compress_process(state->u.lzma_state, rv =tor_lzma_compress_process(state->u.lzma_state,
out, out_len, in, in_len, out, out_len, in, in_len,
finish); finish);
break;
case ZSTD_METHOD: case ZSTD_METHOD:
return tor_zstd_compress_process(state->u.zstd_state, rv = tor_zstd_compress_process(state->u.zstd_state,
out, out_len, in, in_len, out, out_len, in, in_len,
finish); finish);
break;
case NO_METHOD: case NO_METHOD:
return tor_cnone_compress_process(out, out_len, in, in_len, rv = tor_cnone_compress_process(out, out_len, in, in_len,
finish); finish);
break;
default:
case UNKNOWN_METHOD: case UNKNOWN_METHOD:
goto err; goto err;
} }
if (BUG((rv == TOR_COMPRESS_OK) &&
*in_len == in_len_orig &&
*out_len == out_len_orig)) {
return TOR_COMPRESS_ERROR;
}
return rv;
err: err:
return TOR_COMPRESS_ERROR; return TOR_COMPRESS_ERROR;
} }