nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-24 04:13:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix TROVE-2021-006: Out-of-bounds read on v3 desc parsing

Browse Source
This commit is contained in:
George Kadianakis 2021-05-18 17:06:57 +03:00 committed by Nick Mathewson
parent adb248b6d6
commit f57b5c48e0
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/bug40392 Normal file
View File

@ -0,0 +1,4 @@
o Major bugfixes (security, denial of service, onion services):
- Fix an out-of-bounds memory access in v3 descriptor parsing. Fixes bug
40392; bugfix on 0.3.0.1-alpha. This issue is also tracked as
TROVE-2021-006. Reported by Sergei Glazunov from Google's Project Zero.

3
src/feature/hs/hs_descriptor.c
View File

@ -135,7 +135,7 @@ static token_rule_t hs_desc_superencrypted_v3_token_table[] = {
/* Descriptor ruleset for the encrypted section. */ /* Descriptor ruleset for the encrypted section. */
static token_rule_t hs_desc_encrypted_v3_token_table[] = { static token_rule_t hs_desc_encrypted_v3_token_table[] = {
T1_START(str_create2_formats, R3_CREATE2_FORMATS, CONCAT_ARGS, NO_OBJ), T1_START(str_create2_formats, R3_CREATE2_FORMATS, CONCAT_ARGS, NO_OBJ),
T01(str_intro_auth_required, R3_INTRO_AUTH_REQUIRED, ARGS, NO_OBJ), T01(str_intro_auth_required, R3_INTRO_AUTH_REQUIRED, GE(1), NO_OBJ),
T01(str_single_onion, R3_SINGLE_ONION_SERVICE, ARGS, NO_OBJ), T01(str_single_onion, R3_SINGLE_ONION_SERVICE, ARGS, NO_OBJ),
END_OF_TABLE END_OF_TABLE
}; };
@ -2312,6 +2312,7 @@ desc_decode_encrypted_v3(const hs_descriptor_t *desc,
/* Authentication type. It's optional but only once. */ /* Authentication type. It's optional but only once. */
tok = find_opt_by_keyword(tokens, R3_INTRO_AUTH_REQUIRED); tok = find_opt_by_keyword(tokens, R3_INTRO_AUTH_REQUIRED);
if (tok) { if (tok) {
tor_assert(tok->n_args >= 1);
if (!decode_auth_type(desc_encrypted_out, tok->args[0])) { if (!decode_auth_type(desc_encrypted_out, tok->args[0])) {
log_warn(LD_REND, "Service descriptor authentication type has " log_warn(LD_REND, "Service descriptor authentication type has "
"invalid entry(ies)."); "invalid entry(ies).");