mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2025-02-23 22:47:12 +01:00
Code Issues Projects Releases Wiki Activity

rearrange our assert so we don't possibly overflow rh.length before

Browse source 
triggering the assert. reported by veracode.


svn:r13601
This commit is contained in:
Roger Dingledine 2008-02-19 23:54:17 +00:00
parent 0399538b90
commit 913f66278c
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/or/relay.c
View file

@ -475,6 +475,7 @@ relay_send_command_from_edge(uint16_t stream_id, circuit_t *circ,
/* XXXX NM Split this function into a separate versions per circuit type? */
tor_assert(circ);
tor_assert(payload_len <= RELAY_PAYLOAD_SIZE);
memset(&cell, 0, sizeof(cell_t));
cell.command = CELL_RELAY;
@ -493,10 +494,8 @@ relay_send_command_from_edge(uint16_t stream_id, circuit_t *circ,
rh.stream_id = stream_id;
rh.length = payload_len;
relay_header_pack(cell.payload, &rh);
if (payload_len) {
tor_assert(payload_len <= RELAY_PAYLOAD_SIZE);
if (payload_len)
memcpy(cell.payload+RELAY_HEADER_SIZE, payload, payload_len);
}
log_debug(LD_OR,"delivering %d cell %s.", relay_command,
cell_direction == CELL_DIRECTION_OUT ? "forward" : "backward");