mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-20 10:12:15 +01:00
Code Issues Projects Releases Wiki Activity

Impose maximum sizes on parsed objects

Browse Source 
An object, you'll recall, is something between -----BEGIN----- and
-----END----- tags in a directory document.  Some of our code, as
doorss has noted in bug 2352, could assert if one of these ever
overflowed SIZE_T_CEILING but not INT_MAX.  As a solution, I'm setting
a maximum size on a single object such that neither of these limits
will ever be hit.  I'm also fixing the INT_MAX checks, just to be sure.
This commit is contained in:
Nick Mathewson 2011-01-10 12:12:11 -05:00
parent 729f404efe
commit 373a1bc40e
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
changes/bug2352 Normal file
View File

@ -0,0 +1,6 @@
o Minor bugfixes
- Fix some potential asserts and partsing issues with grossly
malformed router caches. Fixes bug 2352. Found by doorss.
Bugfix on Tor 0.2.1.27.

11
src/or/routerparse.c
View File

@ -2549,7 +2549,7 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out,
goto err;
v->good_signature = 1;
} else {
if (tok->object_size >= INT_MAX)
if (tok->object_size >= INT_MAX || tok->object_size >= SIZE_T_CEILING)
goto err;
/* We already parsed a vote from this voter. Use the first one. */
if (v->signature) {
@ -2700,7 +2700,7 @@ networkstatus_parse_detached_signatures(const char *s, const char *eos)
voter = tor_malloc_zero(sizeof(networkstatus_voter_info_t));
memcpy(voter->identity_digest, id_digest, DIGEST_LEN);
memcpy(voter->signing_key_digest, sk_digest, DIGEST_LEN);
if (tok->object_size >= INT_MAX)
if (tok->object_size >= INT_MAX || tok->object_size >= SIZE_T_CEILING)
goto err;
voter->signature = tor_memdup(tok->object_body, tok->object_size);
voter->signature_len = (int) tok->object_size;
@ -3017,6 +3017,10 @@ static directory_token_t *
get_next_token(memarea_t *area,
const char **s, const char *eos, token_rule_t *table)
{
/** Reject any object at least this big; it is probably an overflow, an
* attack, a bug, or some other nonsense. */
#define MAX_UNPARSED_OBJECT_SIZE (128*1024)
const char *next, *eol, *obstart;
size_t obname_len;
int i;
@ -3126,6 +3130,9 @@ get_next_token(memarea_t *area,
ebuf[sizeof(ebuf)-1] = '\0';
RET_ERR(ebuf);
}
if (next - *s > MAX_UNPARSED_OBJECT_SIZE)
RET_ERR("Couldn't parse object: missing footer or object much too big.");
if (!strcmp(tok->object_type, "RSA PUBLIC KEY")) { /* If it's a public key */
tok->key = crypto_new_pk_env();
if (crypto_pk_read_public_key_from_string(tok->key, obstart, eol-obstart))