mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2025-02-24 22:58:50 +01:00
Code Issues Projects Releases Wiki Activity

rust/protover: use .and_not_in() instead of .retain() in all_supported()

Browse source 
.retain() would allocating a Vec of billions of integers and check them
one at a time to separate the supported versions from the unsupported.
This leads to a memory DoS.

Closes ticket 27206. Bugfix on e6625113c9.
This commit is contained in:
cypherpunks 2018-08-09 21:26:10 +00:00
parent 578f7326ed
commit c613d55134
3 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
changes/bug27206 Normal file
View file

@ -0,0 +1,4 @@
o Minor bugfixes (rust):
- protover_all_supported() would attempt to allocate up to 16GB on some
inputs, leading to a potential memory DoS. Fixes bug 27206; bugfix on
0.3.3.5-rc.

4
src/rust/protover/protover.rs
View file

@ -365,7 +365,6 @@ impl UnvalidatedProtoEntry {
let maybe_supported_versions: Option<&ProtoSet> = supported.get(&supported_protocol);
let supported_versions: &ProtoSet;
let mut unsupported_versions: ProtoSet;
// If the protocol wasn't in the map, then we don't know about it
// and don't support any of its versions. Add its versions to the
@ -378,8 +377,7 @@ impl UnvalidatedProtoEntry {
} else {
supported_versions = maybe_supported_versions.unwrap();
}
unsupported_versions = versions.clone();
unsupported_versions.retain(|x| !supported_versions.contains(x));
let unsupported_versions = versions.and_not_in(supported_versions);
if !unsupported_versions.is_empty() {
unsupported.insert(protocol.clone(), unsupported_versions);

8
src/rust/protover/tests/protover.rs
View file

@ -354,18 +354,18 @@ fn protover_all_supported_should_exclude_some_versions_and_entire_protocols() {
#[test]
fn protover_all_supported_should_not_dos_anyones_computer() {
let proto: UnvalidatedProtoEntry = "Sleen=1-2147483648".parse().unwrap();
let proto: UnvalidatedProtoEntry = "Link=1-2147483648".parse().unwrap();
let result: String = proto.all_supported().unwrap().to_string();
assert_eq!(result, "Sleen=1-2147483648".to_string());
assert_eq!(result, "Link=6-2147483648".to_string());
}
#[test]
fn protover_all_supported_should_not_dos_anyones_computer_max_versions() {
let proto: UnvalidatedProtoEntry = "Sleen=1-4294967294".parse().unwrap();
let proto: UnvalidatedProtoEntry = "Link=1-4294967294".parse().unwrap();
let result: String = proto.all_supported().unwrap().to_string();
assert_eq!(result, "Sleen=1-4294967294".to_string());
assert_eq!(result, "Link=6-4294967294".to_string());
}
#[test]