mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-11 05:33:47 +01:00
Handle relay cells with rh.length too large.
svn:r4264
This commit is contained in:
parent
9abef5e483
commit
e7354725bb
@ -779,6 +779,11 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ,
|
|||||||
num_seen++;
|
num_seen++;
|
||||||
log_fn(LOG_DEBUG,"Now seen %d relay cells here.", num_seen);
|
log_fn(LOG_DEBUG,"Now seen %d relay cells here.", num_seen);
|
||||||
|
|
||||||
|
if (rh.length > RELAY_PAYLOAD_SIZE) {
|
||||||
|
log_fn(LOG_WARN, "Relay cell length field too long. Closing circuit.");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
/* either conn is NULL, in which case we've got a control cell, or else
|
/* either conn is NULL, in which case we've got a control cell, or else
|
||||||
* conn points to the recognized stream. */
|
* conn points to the recognized stream. */
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user