diff options
| author | Nick Mathewson <nickm@torproject.org> | 2021-06-10 12:30:29 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2021-06-10 12:30:29 -0400 |
| commit | e2138627f9b52e9e8aa93387e17f37f3a21d5efd (patch) | |
| tree | 8c1c7ed05c16188e8a999fec33a4f1dbcf1a0f39 | |
| parent | b5eb1ba7220d366c0dc10ae6e292f2c909550801 (diff) | |
| parent | f57b5c48e0aa01acd84a194fe4657a0d1cee04cf (diff) | |
| download | tor-e2138627f9b52e9e8aa93387e17f37f3a21d5efd.tar.gz tor-e2138627f9b52e9e8aa93387e17f37f3a21d5efd.zip | |
Merge branch 'maint-0.3.5' into release-0.3.5
| -rw-r--r-- | changes/bug40392 | 4 | ||||
| -rw-r--r-- | src/feature/hs/hs_descriptor.c | 3 |
2 files changed, 6 insertions, 1 deletions
diff --git a/changes/bug40392 b/changes/bug40392 new file mode 100644 index 0000000000..4dffa50bb2 --- /dev/null +++ b/changes/bug40392 @@ -0,0 +1,4 @@ + o Major bugfixes (security, denial of service, onion services): + - Fix an out-of-bounds memory access in v3 descriptor parsing. Fixes bug + 40392; bugfix on 0.3.0.1-alpha. This issue is also tracked as + TROVE-2021-006. Reported by Sergei Glazunov from Google's Project Zero.
\ No newline at end of file diff --git a/src/feature/hs/hs_descriptor.c b/src/feature/hs/hs_descriptor.c index b6abf14a11..f74bb97ee2 100644 --- a/src/feature/hs/hs_descriptor.c +++ b/src/feature/hs/hs_descriptor.c @@ -135,7 +135,7 @@ static token_rule_t hs_desc_superencrypted_v3_token_table[] = { /* Descriptor ruleset for the encrypted section. */ static token_rule_t hs_desc_encrypted_v3_token_table[] = { T1_START(str_create2_formats, R3_CREATE2_FORMATS, CONCAT_ARGS, NO_OBJ), - T01(str_intro_auth_required, R3_INTRO_AUTH_REQUIRED, ARGS, NO_OBJ), + T01(str_intro_auth_required, R3_INTRO_AUTH_REQUIRED, GE(1), NO_OBJ), T01(str_single_onion, R3_SINGLE_ONION_SERVICE, ARGS, NO_OBJ), END_OF_TABLE }; @@ -2312,6 +2312,7 @@ desc_decode_encrypted_v3(const hs_descriptor_t *desc, /* Authentication type. It's optional but only once. */ tok = find_opt_by_keyword(tokens, R3_INTRO_AUTH_REQUIRED); if (tok) { + tor_assert(tok->n_args >= 1); if (!decode_auth_type(desc_encrypted_out, tok->args[0])) { log_warn(LD_REND, "Service descriptor authentication type has " "invalid entry(ies)."); |