mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2025-02-24 06:48:05 +01:00
Code Issues Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2

Browse source
This commit is contained in:
Nick Mathewson 2011-12-15 11:28:44 -05:00
commit 562c974ee7
2 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
changes/buffer_bug Normal file
View file

@ -0,0 +1,7 @@
o Major bugfixes:
- Fix a heap overflow bug that could occur when trying to pull
data into the first chunk of a buffer, when that chunk had
already had some data drained from it. Fixes CVE-2011-2778;
bugfix on 0.2.0.16-alpha. Reported by "Vektor".

5
src/or/buffers.c
View file

@ -397,9 +397,10 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate)
if (buf->head->memlen >= capacity) {
/* We don't need to grow the first chunk, but we might need to repack it.*/
if (CHUNK_REMAINING_CAPACITY(buf->head) < capacity-buf->datalen)
size_t needed = capacity - buf->head->datalen;
if (CHUNK_REMAINING_CAPACITY(buf->head) < needed)
chunk_repack(buf->head);
tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= capacity-buf->datalen);
tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= needed);
} else {
chunk_t *newhead;
size_t newsize;