diff options
| author | Nick Mathewson <nickm@torproject.org> | 2011-01-15 11:32:56 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2011-01-15 14:10:54 -0500 |
| commit | ef6fa07e4830dde86fce2d06bf9da44d5c1c79b9 (patch) | |
| tree | af032e6433f29d1d36c411e6bc624a72ed33e815 | |
| parent | 9b09627edd2e1dcaed4ca8382bde3cf608ce6a81 (diff) | |
| download | tor-ef6fa07e4830dde86fce2d06bf9da44d5c1c79b9.tar.gz tor-ef6fa07e4830dde86fce2d06bf9da44d5c1c79b9.zip | |
Fix a couple of non-cleared key issues in hidden services
we need to do more hunting, but this fixes the ones mentioned in 2385.
| -rw-r--r-- | changes/bug2384 | 3 | ||||
| -rw-r--r-- | src/or/rendclient.c | 2 | ||||
| -rw-r--r-- | src/or/rendservice.c | 2 |
3 files changed, 6 insertions, 1 deletions
diff --git a/changes/bug2384 b/changes/bug2384 index 5321814424..ded5eee992 100644 --- a/changes/bug2384 +++ b/changes/bug2384 @@ -1,5 +1,6 @@ o Minor bugfixes - Zero out a few more keys in memory before freeing them. Fixes bug - 2384. Found by cypherpunks. Bugfix on 0.0.2pre9. + 2384 and part of bug 2385. These key instances found by + "cypherpunks". Bugfix on 0.0.2pre9. diff --git a/src/or/rendclient.c b/src/or/rendclient.c index ab18d35298..95875465cb 100644 --- a/src/or/rendclient.c +++ b/src/or/rendclient.c @@ -717,8 +717,10 @@ rend_client_receive_rendezvous(origin_circuit_t *circ, const uint8_t *request, * attach only the connections that are waiting on this circuit, rather * than trying to attach them all. See comments bug 743. */ connection_ap_attach_pending(); + memset(keys, 0, sizeof(keys)); return 0; err: + memset(keys, 0, sizeof(keys)); circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_TORPROTOCOL); return -1; } diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 07f01aead9..a650eda405 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -1214,8 +1214,10 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, memcpy(cpath->handshake_digest, keys, DIGEST_LEN); if (extend_info) extend_info_free(extend_info); + memset(keys, 0, sizeof(keys)); return 0; err: + memset(keys, 0, sizeof(keys)); if (dh) crypto_dh_free(dh); if (launched) circuit_mark_for_close(TO_CIRCUIT(launched), reason); |