nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 13:13:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix a few crash bugs related to malormed descriptors. Lark found one; fuzzing found the rest.

Browse Source 
svn:r19250
This commit is contained in:
Nick Mathewson 2009-04-09 19:58:16 +00:00
parent 37e8a28c7c
commit d50501e5ed
2 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -1,4 +1,8 @@
Changes in version 0.2.1.14-??? - 2009-04-?? Changes in version 0.2.1.14-??? - 2009-04-??
o Security fixes:
- Avoid crashing in the presence of certain malformed descriptors.
Found by lark, and by automated fuzzing.
o Minor bugfixes: o Minor bugfixes:
- Avoid trying to print raw memory to the logs when we decide to - Avoid trying to print raw memory to the logs when we decide to
give up on downloading a given relay descriptor. Bugfix on give up on downloading a given relay descriptor. Bugfix on

15
src/or/routerparse.c
View File

@ -411,7 +411,7 @@ static token_rule_t networkstatus_consensus_token_table[] = {
T0N("opt", K_OPT, CONCAT_ARGS, OBJ_OK ), T0N("opt", K_OPT, CONCAT_ARGS, OBJ_OK ),
T1N("dir-source", K_DIR_SOURCE, GE(3), NO_OBJ ), T1N("dir-source", K_DIR_SOURCE, GE(6), NO_OBJ ),
T1N("contact", K_CONTACT, CONCAT_ARGS, NO_OBJ ), T1N("contact", K_CONTACT, CONCAT_ARGS, NO_OBJ ),
T1N("vote-digest", K_VOTE_DIGEST, GE(1), NO_OBJ ), T1N("vote-digest", K_VOTE_DIGEST, GE(1), NO_OBJ ),
@ -1933,7 +1933,7 @@ routerstatus_parse_entry_from_string(memarea_t *area,
tor_assert(tok->n_args == 1); tor_assert(tok->n_args == 1);
if (strcmpstart(tok->args[0], "accept ") && if (strcmpstart(tok->args[0], "accept ") &&
strcmpstart(tok->args[0], "reject ")) { strcmpstart(tok->args[0], "reject ")) {
log_err(LD_DIR, "Unknown exit policy summary type %s.", log_warn(LD_DIR, "Unknown exit policy summary type %s.",
escaped(tok->args[0])); escaped(tok->args[0]));
goto err; goto err;
} }
@ -2311,8 +2311,7 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out,
ns->voters = smartlist_create(); ns->voters = smartlist_create();
SMARTLIST_FOREACH(tokens, directory_token_t *, _tok, SMARTLIST_FOREACH_BEGIN(tokens, directory_token_t *, _tok) {
{
tok = _tok; tok = _tok;
if (tok->tp == K_DIR_SOURCE) { if (tok->tp == K_DIR_SOURCE) {
tor_assert(tok->n_args >= 6); tor_assert(tok->n_args >= 6);
@ -2369,11 +2368,11 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out,
base16_decode(voter->vote_digest, sizeof(voter->vote_digest), base16_decode(voter->vote_digest, sizeof(voter->vote_digest),
tok->args[0], HEX_DIGEST_LEN) < 0) { tok->args[0], HEX_DIGEST_LEN) < 0) {
log_warn(LD_DIR, "Error decoding vote digest %s in " log_warn(LD_DIR, "Error decoding vote digest %s in "
"network-status consensus.", escaped(tok->args[1])); "network-status consensus.", escaped(tok->args[0]));
goto err; goto err;
} }
} }
}); } SMARTLIST_FOREACH_END(_tok);
if (voter) { if (voter) {
smartlist_add(ns->voters, voter); smartlist_add(ns->voters, voter);
voter = NULL; voter = NULL;
@ -2903,6 +2902,7 @@ token_check_object(memarea_t *area, const char *kwd,
case NEED_KEY: /* There must be some kind of key. */ case NEED_KEY: /* There must be some kind of key. */
if (!tok->key) { if (!tok->key) {
tor_snprintf(ebuf, sizeof(ebuf), "Missing public key for %s", kwd); tor_snprintf(ebuf, sizeof(ebuf), "Missing public key for %s", kwd);
RET_ERR(ebuf);
} }
if (o_syn != NEED_SKEY_1024) { if (o_syn != NEED_SKEY_1024) {
if (crypto_pk_key_is_private(tok->key)) { if (crypto_pk_key_is_private(tok->key)) {
@ -3049,8 +3049,7 @@ get_next_token(memarea_t *area,
goto check_object; goto check_object;
obstart = *s; /* Set obstart to start of object spec */ obstart = *s; /* Set obstart to start of object spec */
tor_assert(eol >= (*s+16)); if (*s+16 >= eol || memchr(*s+11,'\0',eol-*s-16) || /* no short lines, */
if (*s+11 >= eol-5 || memchr(*s+11,'\0',eol-*s-16) || /* no short lines, */
strcmp_len(eol-5, "-----", 5)) { /* nuls or invalid endings */ strcmp_len(eol-5, "-----", 5)) { /* nuls or invalid endings */
RET_ERR("Malformed object: bad begin line"); RET_ERR("Malformed object: bad begin line");
} }