mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2025-02-25 15:10:48 +01:00
Code Issues Projects Releases Wiki Activity

Merge branch 'maint-0.3.5'

Browse source
This commit is contained in:
Nick Mathewson 2018-10-29 15:57:31 -04:00
commit fda8b5de78
3 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
changes/bug28202 Normal file
View file

@ -0,0 +1,4 @@
o Minor bugfixes (C correctness):
- Avoid undefined behavior in an end-of-string check when parsing the
BEGIN line in a directory object. Fixes bug 28202; bugfix on
0.2.0.3-alpha.

6
src/feature/dirparse/microdesc_parse.c
View file

@ -50,13 +50,13 @@ find_start_of_next_microdesc(const char *s, const char *eos)
return NULL; return NULL;
#define CHECK_LENGTH() STMT_BEGIN \ #define CHECK_LENGTH() STMT_BEGIN \
if (s+32 > eos) \ if (eos - s < 32) \
return NULL; \ return NULL; \
STMT_END STMT_END
#define NEXT_LINE() STMT_BEGIN \ #define NEXT_LINE() STMT_BEGIN \
s = memchr(s, '\n', eos-s); \ s = memchr(s, '\n', eos-s); \
if (!s || s+1 >= eos) \ if (!s || eos - s <= 1) \
return NULL; \ return NULL; \
s++; \ s++; \
STMT_END STMT_END
@ -80,7 +80,7 @@ find_start_of_next_microdesc(const char *s, const char *eos)
/* Okay, now we're pointed at the first line of the microdescriptor which is /* Okay, now we're pointed at the first line of the microdescriptor which is
not an annotation or onion-key. The next line that _is_ an annotation or not an annotation or onion-key. The next line that _is_ an annotation or
onion-key is the start of the next microdescriptor. */ onion-key is the start of the next microdescriptor. */
while (s+32 < eos) { while (eos - s > 32) {
if (*s == '@' || !strcmpstart(s, "onion-key")) if (*s == '@' || !strcmpstart(s, "onion-key"))
return s; return s;
NEXT_LINE(); NEXT_LINE();

2
src/feature/dirparse/parsecommon.c
View file

@ -353,7 +353,7 @@ get_next_token(memarea_t *area,
goto check_object; goto check_object;
obstart = *s; /* Set obstart to start of object spec */ obstart = *s; /* Set obstart to start of object spec */
if (*s+16 >= eol || memchr(*s+11,'\0',eol-*s-16) || /* no short lines, */ if (eol - *s <= 16 || memchr(*s+11,'\0',eol-*s-16) || /* no short lines, */
strcmp_len(eol-5, "-----", 5) || /* nuls or invalid endings */ strcmp_len(eol-5, "-----", 5) || /* nuls or invalid endings */
(eol-*s) > MAX_UNPARSED_OBJECT_SIZE) { /* name too long */ (eol-*s) > MAX_UNPARSED_OBJECT_SIZE) { /* name too long */
RET_ERR("Malformed object: bad begin line"); RET_ERR("Malformed object: bad begin line");