mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2025-02-26 23:52:30 +01:00
5240afa713
If it decrypts something that turns out to start with a NUL byte, then decrypt_desc_layer() will return 0 to indicate the length of its result. But 0 also indicates an error, which causes the result not to be freed by decrypt_desc_layer()'s callers. Since we're trying to stabilize 0.3.2.x, I've opted for the simpler possible fix here and made it so that an empty decrypted string will also count as an error. Fixes bug 24150 and OSS-Fuzz issue 3994. The original bug was present but unreachable in 0.3.1.1-alpha. I'm calling this a bugfix on 0.3.2.1-alpha since that's the first version where you could actually try to decrypt these descriptors. |
||
|---|---|---|
| .. | ||
| dict | ||
| fixup_filenames.sh | ||
| fuzz_consensus.c | ||
| fuzz_descriptor.c | ||
| fuzz_diff.c | ||
| fuzz_diff_apply.c | ||
| fuzz_extrainfo.c | ||
| fuzz_hsdescv2.c | ||
| fuzz_hsdescv3.c | ||
| fuzz_http.c | ||
| fuzz_http_connect.c | ||
| fuzz_iptsv2.c | ||
| fuzz_microdesc.c | ||
| fuzz_multi.sh | ||
| fuzz_vrs.c | ||
| fuzzing.h | ||
| fuzzing_common.c | ||
| include.am | ||
| minimize.sh | ||