diff options
| author | Nick Mathewson <nickm@torproject.org> | 2019-02-21 10:08:14 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2019-02-21 10:08:14 -0500 |
| commit | b478f8e4057191b709b63e51e579230b212439f5 (patch) | |
| tree | 0ad864e31bce02a0113cb50ba3e6b10c3330cfe5 | |
| parent | 1725699e0613521c7d2802f0bf22a8d40634aa9c (diff) | |
| parent | be84ed1a64ed7ce810bd3924fa96c2588b491ef5 (diff) | |
| download | tor-b478f8e4057191b709b63e51e579230b212439f5.tar.gz tor-b478f8e4057191b709b63e51e579230b212439f5.zip | |
Merge branch 'maint-0.3.3' into release-0.3.3
| -rw-r--r-- | changes/ticket29168 | 5 | ||||
| -rw-r--r-- | src/or/scheduler_kist.c | 2 |
2 files changed, 6 insertions, 1 deletions
diff --git a/changes/ticket29168 b/changes/ticket29168 new file mode 100644 index 0000000000..65c5232f65 --- /dev/null +++ b/changes/ticket29168 @@ -0,0 +1,5 @@ + o Major bugfixes (cell scheduler, KIST): + - Make KIST to always take into account the outbuf length when computing + what we can actually put in the outbuf. This could lead to the outbuf + being filled up and thus a possible memory DoS vector. TROVE-2019-001. + Fixes bug 29168; bugfix on 0.3.2.1-alpha. diff --git a/src/or/scheduler_kist.c b/src/or/scheduler_kist.c index 6d6490077d..fb33a5d1d8 100644 --- a/src/or/scheduler_kist.c +++ b/src/or/scheduler_kist.c @@ -280,7 +280,7 @@ update_socket_info_impl, (socket_table_ent_t *ent)) extra_space = clamp_double_to_int64( (ent->cwnd * (int64_t)ent->mss) * sock_buf_size_factor) - - ent->notsent; + ent->notsent - (int64_t)channel_outbuf_length((channel_t *) ent->chan); if ((tcp_space + extra_space) < 0) { /* This means that the "notsent" queue is just too big so we shouldn't put * more in the kernel for now. */ |