mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-24 20:33:31 +01:00
092ac26ea2
In C, it's a bad idea to do this:
char *cp = array;
char *end = array + array_len;
/* .... */
if (cp + 3 >= end) { /* out of bounds */ }
because cp+3 might be more than one off the end of the array, and
you are only allowed to construct pointers to the array elements,
and to an element one past the end. Instead you have to say
if (cp - array + 3 >= array_len) { /* ... */ }
or something like that.
This patch fixes two of these: one in process_versions_cell
introduced in 0.2.0.10-alpha, and one in process_certs_cell
introduced in 0.2.3.6-alpha. These are both tracked under bug
10363. "bobnomnom" found and reported both. See also 10313.
In our code, this is likely to be a problem as we used it only if we
get a nasty allocator that makes allocations end close to (void*)-1.
But it's best not to have to worry about such things at all, so
let's just fix all of these we can find.
7 lines
272 B
Plaintext
7 lines
272 B
Plaintext
o Major bugfixes:
|
|
- Fix two instances of possible undefined behavior in channeltls.c
|
|
that could, under unlucky circumstances, have led to a pointer
|
|
overflow. Fixes bug #10363; bugfixes on 0.2.0.10-alpha and
|
|
0.2.3.6-alpha. Reported by "bobnomnom".
|
|
|