mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2025-02-22 22:25:51 +01:00
Detect insanely large circuit build state; don't give its length to rand_int
This commit is contained in:
parent
5afab5ca19
commit
42e4e156d9
2 changed files with 13 additions and 1 deletions
|
@ -3,3 +3,7 @@
|
|||
correctly. Previously, it accepted values up to UINT_MAX, but
|
||||
could return a negative number if given a value above INT_MAX+1.
|
||||
Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14.
|
||||
|
||||
- Avoid a segfault when reading a malformed circuit build state
|
||||
with more than INT_MAX entries. Found by wanoskarnet. Bugfix on
|
||||
0.2.2.4-alpha.
|
||||
|
|
|
@ -678,7 +678,15 @@ circuit_build_times_shuffle_and_store_array(circuit_build_times_t *cbt,
|
|||
log_notice(LD_CIRC, "The number of circuit times that this Tor version "
|
||||
"uses to calculate build times is less than the number stored "
|
||||
"in your state file. Decreasing the circuit time history from "
|
||||
"%d to %d.", num_times, CBT_NCIRCUITS_TO_OBSERVE);
|
||||
"%lu to %d.", (unsigned long)num_times,
|
||||
CBT_NCIRCUITS_TO_OBSERVE);
|
||||
}
|
||||
|
||||
if (n > INT_MAX-1) {
|
||||
log_warn(LD_CIRC, "For some insane reasons, you had %lu circuit build "
|
||||
"observations in your state file. That's far too many; probably "
|
||||
"there's a bug here.", (unsigned long)n);
|
||||
n = INT_MAX-1;
|
||||
}
|
||||
|
||||
/* This code can only be run on a compact array */
|
||||
|
|
Loading…
Add table
Reference in a new issue