mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2025-02-23 06:35:28 +01:00
Code Issues Projects Releases Wiki Activity

r13602@Kushana: nickm | 2007-07-07 23:44:24 -0400

Browse source 
Backport candidate: fix a possible buffer overrun when using natd support on old BSDs.  Based on a patch from "Mr. Croup".


svn:r10760
This commit is contained in:
Nick Mathewson 2007-07-08 03:45:47 +00:00
parent db3a4bf897
commit 10e5ed1a84
2 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ChangeLog
View file

@ -66,6 +66,10 @@ Changes in version 0.2.0.3-alpha - 2007-??-??
never choose any guards past it. This way we don't expand our
guard list unless we need to. [Bugfix in 0.1.2.x]
o Security fixes (BSD natd support):
- Fix a possible buffer overrun when using BSD natd support. Bug found
by croup.
Changes in version 0.2.0.2-alpha - 2007-06-02
o Major bugfixes on 0.2.0.1-alpha:

12
src/or/connection_edge.c
View file

@ -1702,10 +1702,14 @@ connection_ap_process_natd(edge_connection_t *conn)
}
daddr = tbuf = &tmp_buf[0] + 6; /* after end of "[DEST " */
while (*tbuf != '\0' && *tbuf != ' ')
tbuf++;
*tbuf = '\0';
tbuf++;
if (!(tbuf = strchr(tbuf, ' '))) {
log_warn(LD_APP,"Natd handshake was ill-formed; closing. The client "
"said: %s",
escaped(tmp_buf));
connection_mark_unattached_ap(conn, END_STREAM_REASON_INVALID_NATD_DEST);
return -1;
}
*tbuf++ = '\0';
/* pretend that a socks handshake completed so we don't try to
* send a socks reply down a natd conn */