diff options
| author | Nick Mathewson <nickm@torproject.org> | 2017-07-05 13:43:31 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2017-07-05 13:43:31 -0400 |
| commit | 0832f1cb8fbe6ddbaaef25f2152548f0f647aa8e (patch) | |
| tree | 25a23b7a486c1d975f72f7953cd77ca53d1a2088 | |
| parent | a8fcb6aa1a9f60d8335c2c9d775a61e61b2cc278 (diff) | |
| parent | 6cd6d488dc2469df82d74f0fcc3c84f5b45e8447 (diff) | |
| download | tor-0832f1cb8fbe6ddbaaef25f2152548f0f647aa8e.tar.gz tor-0832f1cb8fbe6ddbaaef25f2152548f0f647aa8e.zip | |
Merge branch 'maint-0.2.7-redux' into release-0.2.7-redux
| -rw-r--r-- | changes/bug22789 | 6 | ||||
| -rw-r--r-- | src/common/compat.c | 8 | ||||
| -rw-r--r-- | src/test/test_addr.c | 9 |
3 files changed, 21 insertions, 2 deletions
diff --git a/changes/bug22789 b/changes/bug22789 new file mode 100644 index 0000000000..dc9fa29811 --- /dev/null +++ b/changes/bug22789 @@ -0,0 +1,6 @@ + o Major bugfixes (openbsd, denial-of-service): + - Avoid an assertion failure bug affecting our implementation of + inet_pton(AF_INET6) on certain OpenBSD systems whose strtol() + handling of "0xfoo" differs from what we had expected. + Fixes bug 22789; bugfix on 0.2.3.8-alpha. + diff --git a/src/common/compat.c b/src/common/compat.c index 7d72b4b7fd..a1d59e530d 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -2452,8 +2452,12 @@ tor_inet_pton(int af, const char *src, void *dst) char *next; ssize_t len; long r = strtol(src, &next, 16); - tor_assert(next != NULL); - tor_assert(next != src); + if (next == NULL || next == src) { + /* The 'next == src' error case can happen on versions of openbsd + * where treats "0xfoo" as an error, rather than as "0" followed by + * "xfoo". */ + return 0; + } len = *next == '\0' ? eow - src : next - src; if (len > 4) diff --git a/src/test/test_addr.c b/src/test/test_addr.c index 2c25c1ef7d..0f77e73630 100644 --- a/src/test/test_addr.c +++ b/src/test/test_addr.c @@ -353,6 +353,15 @@ test_addr_ip6_helpers(void *arg) test_pton6_bad("1.2.3.4"); test_pton6_bad(":1.2.3.4"); test_pton6_bad(".2.3.4"); + /* Regression tests for 22789. */ + test_pton6_bad("0xfoo"); + test_pton6_bad("0x88"); + test_pton6_bad("0xyxxy"); + test_pton6_bad("0XFOO"); + test_pton6_bad("0X88"); + test_pton6_bad("0XYXXY"); + test_pton6_bad("0x"); + test_pton6_bad("0X"); /* test internal checking */ test_external_ip("fbff:ffff::2:7", 0); |