diff options
| author | Nick Mathewson <nickm@torproject.org> | 2015-05-05 15:06:57 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2015-05-05 15:06:57 -0400 |
| commit | b0ea36d779a0d9e5d94bdb056fb20b93240e404c (patch) | |
| tree | eff4a208776a9c6c1a3898b465e69485e38d1303 | |
| parent | caaaea2ac936a1a8bfa0d54498447488b4525768 (diff) | |
| parent | 2b27ce52d2b96a91410fbf8e9c6f2ce7cf036961 (diff) | |
| download | tor-b0ea36d779a0d9e5d94bdb056fb20b93240e404c.tar.gz tor-b0ea36d779a0d9e5d94bdb056fb20b93240e404c.zip | |
Merge remote-tracking branch 'public/bug15821_025'
| -rw-r--r-- | changes/bug15823 | 4 | ||||
| -rw-r--r-- | src/or/rendservice.c | 18 |
2 files changed, 18 insertions, 4 deletions
diff --git a/changes/bug15823 b/changes/bug15823 new file mode 100644 index 0000000000..987de5d9ac --- /dev/null +++ b/changes/bug15823 @@ -0,0 +1,4 @@ + o Minor bugfixes (hidden service): + - Fix an out-of-bounds read when parsing invalid INTRODUCE2 cells + on a client authorized hidden service. Fixes bug 15823; bugfix + on 0.2.1.6-alpha. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 7cfbcf124a..0a984f1447 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -1310,11 +1310,13 @@ rend_service_requires_uptime(rend_service_t *service) return 0; } -/** Check client authorization of a given <b>descriptor_cookie</b> for - * <b>service</b>. Return 1 for success and 0 for failure. */ +/** Check client authorization of a given <b>descriptor_cookie</b> of + * length <b>cookie_len</b> for <b>service</b>. Return 1 for success + * and 0 for failure. */ static int rend_check_authorization(rend_service_t *service, - const char *descriptor_cookie) + const char *descriptor_cookie, + size_t cookie_len) { rend_authorized_client_t *auth_client = NULL; tor_assert(service); @@ -1325,6 +1327,13 @@ rend_check_authorization(rend_service_t *service, return 0; } + if (cookie_len != REND_DESC_COOKIE_LEN) { + log_info(LD_REND, "Descriptor cookie is %lu bytes, but we expected " + "%lu bytes. Dropping cell.", + (unsigned long)cookie_len, (unsigned long)REND_DESC_COOKIE_LEN); + return 0; + } + /* Look up client authorization by descriptor cookie. */ SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, client, { if (tor_memeq(client->descriptor_cookie, descriptor_cookie, @@ -1672,7 +1681,8 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, if (service->clients) { if (parsed_req->version == 3 && parsed_req->u.v3.auth_len > 0) { if (rend_check_authorization(service, - (const char*)parsed_req->u.v3.auth_data)) { + (const char*)parsed_req->u.v3.auth_data, + parsed_req->u.v3.auth_len)) { log_info(LD_REND, "Authorization data in INTRODUCE2 cell are valid."); } else { log_info(LD_REND, "The authorization data that are contained in " |