diff options
| author | Nick Mathewson <nickm@torproject.org> | 2014-04-29 13:03:27 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2014-04-29 13:03:27 -0400 |
| commit | 0514bcd37c6e6e0eb3f3c47da94cb182d01ef15f (patch) | |
| tree | 3ce1c5cea0b3733055ffd3ca9f7d0c620358f4ef | |
| parent | c0a73c8bf327e18b09b71cd77edcfac7fb9d3c69 (diff) | |
| parent | 1d3ffc0ec96777203b2eafee5905464d54ef9f91 (diff) | |
| download | tor-0514bcd37c6e6e0eb3f3c47da94cb182d01ef15f.tar.gz tor-0514bcd37c6e6e0eb3f3c47da94cb182d01ef15f.zip | |
Merge remote-tracking branch 'origin/maint-0.2.4'
| -rw-r--r-- | changes/md_leak_bug | 5 | ||||
| -rw-r--r-- | src/or/routerparse.c | 2 |
2 files changed, 7 insertions, 0 deletions
diff --git a/changes/md_leak_bug b/changes/md_leak_bug new file mode 100644 index 0000000000..26270aacc3 --- /dev/null +++ b/changes/md_leak_bug @@ -0,0 +1,5 @@ + o Major bugfixes (security, OOM) + - Fix a memory leak that could occur if a microdescriptor parse + fails during the tokenizing step. This could enable a memory + exhaustion attack by directory servers. Fixes bug #11649; bugfix + on 0.2.2.6-alpha. diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 14f800e7be..5add728d6d 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -4129,11 +4129,13 @@ microdescs_parse_from_string(const char *s, const char *eos, microdesc_free(md); md = NULL; + SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_clear(t)); memarea_clear(area); smartlist_clear(tokens); s = start_of_next_microdesc; } + SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_clear(t)); memarea_drop_all(area); smartlist_free(tokens); |