diff options
author | Nick Mathewson <nickm@torproject.org> | 2016-12-20 18:05:47 -0500 |
---|---|---|
committer | Nick Mathewson <nickm@torproject.org> | 2016-12-20 18:05:47 -0500 |
commit | ec3df7cbd2d122d66bab7c389715ff9579eb0899 (patch) | |
tree | 0e4ddb9e738a1643addf6cdc9069a56431da9b6a | |
parent | ce12cde92c023f8ce5d227a7526c01279cbce132 (diff) | |
parent | 0fb3058eced5dce355d777288bd9ec255b875db4 (diff) | |
download | tor-ec3df7cbd2d122d66bab7c389715ff9579eb0899.tar.gz tor-ec3df7cbd2d122d66bab7c389715ff9579eb0899.zip |
Merge branch 'maint-0.2.4' into release-0.2.4
-rw-r--r-- | changes/bug21018 | 11 | ||||
-rw-r--r-- | src/or/rendcommon.c | 6 | ||||
-rw-r--r-- | src/or/routerparse.c | 6 |
3 files changed, 18 insertions, 5 deletions
diff --git a/changes/bug21018 b/changes/bug21018 new file mode 100644 index 0000000000..49a8b47a25 --- /dev/null +++ b/changes/bug21018 @@ -0,0 +1,11 @@ + o Major bugfixes (parsing, security): + + - Fix a bug in parsing that could cause clients to read a single + byte past the end of an allocated region. This bug could be + used to cause hardened clients (built with + --enable-expensive-hardening) to crash if they tried to visit + a hostile hidden service. Non-hardened clients are only + affected depending on the details of their platform's memory + allocator. Fixes bug 21018; bugfix on 0.2.0.8-alpha. Found by + using libFuzzer. Also tracked as TROVE-2016-12-002 and as + CVE-2016-1254. diff --git a/src/or/rendcommon.c b/src/or/rendcommon.c index d1f8b1af99..296df55664 100644 --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@ -1327,8 +1327,10 @@ rend_cache_store_v2_desc_as_client(const char *desc, intro_size); if (n_intro_points <= 0) { log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); + "service has published a corrupt descriptor, or you have " + "provided invalid authorization data, or (maybe!) the " + "server is deliberately serving broken data in an attempt " + "to crash you with bug 21018."); retval = -2; goto err; } else if (n_intro_points > MAX_INTRO_POINTS) { diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 176c16f904..71373ce63e 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3857,7 +3857,7 @@ get_next_token(memarea_t *area, if (tok->tp == ERR_) { /* No keyword matched; call it an "K_opt" or "A_unrecognized" */ - if (**s == '@') + if (*s < eol && **s == '@') tok->tp = A_UNKNOWN_; else tok->tp = K_OPT; @@ -4863,7 +4863,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, crypto_cipher_free(cipher); len = ipos_encrypted_size - 2 - client_entries_len - CIPHER_IV_LEN; - dec = tor_malloc(len); + dec = tor_malloc_zero(len + 1); declen = crypto_cipher_decrypt_with_iv(session_key, dec, len, ipos_encrypted + 2 + client_entries_len, ipos_encrypted_size - 2 - client_entries_len); @@ -4895,7 +4895,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, "small."); return -1; } - dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1); + dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1 + 1); declen = crypto_cipher_decrypt_with_iv(descriptor_cookie, dec, ipos_encrypted_size - |