diff options
| author | David Goulet <dgoulet@torproject.org> | 2022-07-27 11:33:19 -0400 |
|---|---|---|
| committer | David Goulet <dgoulet@torproject.org> | 2022-07-27 11:33:19 -0400 |
| commit | ee20d74672dae079cb7edfc44e5ac33c7ed523f8 (patch) | |
| tree | e3f08cb502036f321d23e58fb4002f47d57f5326 | |
| parent | 2dee45267bde9243afdbf1e7e44a496732b9b2fa (diff) | |
| parent | e618a7e4456ae6a1bcb96d8d5f2c972796dd515a (diff) | |
| download | tor-ee20d74672dae079cb7edfc44e5ac33c7ed523f8.tar.gz tor-ee20d74672dae079cb7edfc44e5ac33c7ed523f8.zip | |
Merge branch 'maint-0.4.6' into release-0.4.6
| -rw-r--r-- | changes/bug40645 | 5 | ||||
| -rw-r--r-- | src/core/or/channelpadding.c | 2 | ||||
| -rw-r--r-- | src/core/or/command.c | 2 |
3 files changed, 7 insertions, 2 deletions
diff --git a/changes/bug40645 b/changes/bug40645 new file mode 100644 index 0000000000..044d5b67d2 --- /dev/null +++ b/changes/bug40645 @@ -0,0 +1,5 @@ + o Minor bugfixes (defense in depth): + - Change a test in the netflow padding code to make it more + _obviously_ safe against remotely triggered crashes. + (It was safe against these before, but not obviously so.) + Fixes bug 40645; bugfix on 0.3.1.1-alpha. diff --git a/src/core/or/channelpadding.c b/src/core/or/channelpadding.c index 47a04e5248..1f559f6c42 100644 --- a/src/core/or/channelpadding.c +++ b/src/core/or/channelpadding.c @@ -186,7 +186,7 @@ channelpadding_get_netflow_inactive_timeout_ms(const channel_t *chan) high_timeout = MAX(high_timeout, chan->padding_timeout_high_ms); } - if (low_timeout == high_timeout) + if (low_timeout >= high_timeout) return low_timeout; // No randomization /* diff --git a/src/core/or/command.c b/src/core/or/command.c index 1343177db4..c08b255914 100644 --- a/src/core/or/command.c +++ b/src/core/or/command.c @@ -664,7 +664,7 @@ command_process_destroy_cell(cell_t *cell, channel_t *chan) * DESTROY cell down the circuit so relays can stop queuing in-flight * cells for this circuit which helps with memory pressure. */ log_debug(LD_OR, "Received DESTROY cell from n_chan, closing circuit."); - circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL); + circuit_mark_for_close(circ, reason | END_CIRC_REASON_FLAG_REMOTE); } } } |