diff options
| author | Nick Mathewson <nickm@torproject.org> | 2011-06-01 12:12:01 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2011-06-06 16:18:06 -0400 |
| commit | 42e4e156d95a1c28a666a5346d491c4ed71435dd (patch) | |
| tree | 66e8380b129be449e895fa93b7240f80985e7be8 | |
| parent | 5afab5ca197112b01135980d6cb3694a4519e3cf (diff) | |
| download | tor-42e4e156d95a1c28a666a5346d491c4ed71435dd.tar.gz tor-42e4e156d95a1c28a666a5346d491c4ed71435dd.zip | |
Detect insanely large circuit build state; don't give its length to rand_int
| -rw-r--r-- | changes/bug3306 | 4 | ||||
| -rw-r--r-- | src/or/circuitbuild.c | 10 |
2 files changed, 13 insertions, 1 deletions
diff --git a/changes/bug3306 b/changes/bug3306 index b1bb1035cf..f868a24af0 100644 --- a/changes/bug3306 +++ b/changes/bug3306 @@ -3,3 +3,7 @@ correctly. Previously, it accepted values up to UINT_MAX, but could return a negative number if given a value above INT_MAX+1. Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14. + + - Avoid a segfault when reading a malformed circuit build state + with more than INT_MAX entries. Found by wanoskarnet. Bugfix on + 0.2.2.4-alpha. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 3f08448159..6d7e71194e 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -678,7 +678,15 @@ circuit_build_times_shuffle_and_store_array(circuit_build_times_t *cbt, log_notice(LD_CIRC, "The number of circuit times that this Tor version " "uses to calculate build times is less than the number stored " "in your state file. Decreasing the circuit time history from " - "%d to %d.", num_times, CBT_NCIRCUITS_TO_OBSERVE); + "%lu to %d.", (unsigned long)num_times, + CBT_NCIRCUITS_TO_OBSERVE); + } + + if (n > INT_MAX-1) { + log_warn(LD_CIRC, "For some insane reasons, you had %lu circuit build " + "observations in your state file. That's far too many; probably " + "there's a bug here.", (unsigned long)n); + n = INT_MAX-1; } /* This code can only be run on a compact array */ |