mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2025-02-23 14:40:51 +01:00
Code Issues Projects Releases Wiki Activity

Detect insanely large circuit build state; don't give its length to rand_int

Browse source
This commit is contained in:
Nick Mathewson 2011-06-01 12:12:01 -04:00
parent 5afab5ca19
commit 42e4e156d9
2 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
changes/bug3306
View file

@ -3,3 +3,7 @@
correctly. Previously, it accepted values up to UINT_MAX, but correctly. Previously, it accepted values up to UINT_MAX, but
could return a negative number if given a value above INT_MAX+1. could return a negative number if given a value above INT_MAX+1.
Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14. Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14.
- Avoid a segfault when reading a malformed circuit build state
with more than INT_MAX entries. Found by wanoskarnet. Bugfix on
0.2.2.4-alpha.

10
src/or/circuitbuild.c
View file

@ -678,7 +678,15 @@ circuit_build_times_shuffle_and_store_array(circuit_build_times_t *cbt,
log_notice(LD_CIRC, "The number of circuit times that this Tor version " log_notice(LD_CIRC, "The number of circuit times that this Tor version "
"uses to calculate build times is less than the number stored " "uses to calculate build times is less than the number stored "
"in your state file. Decreasing the circuit time history from " "in your state file. Decreasing the circuit time history from "
"%d to %d.", num_times, CBT_NCIRCUITS_TO_OBSERVE); "%lu to %d.", (unsigned long)num_times,
CBT_NCIRCUITS_TO_OBSERVE);
}
if (n > INT_MAX-1) {
log_warn(LD_CIRC, "For some insane reasons, you had %lu circuit build "
"observations in your state file. That's far too many; probably "
"there's a bug here.", (unsigned long)n);
n = INT_MAX-1;
} }
/* This code can only be run on a compact array */ /* This code can only be run on a compact array */