diff options
| author | Nick Mathewson <nickm@torproject.org> | 2016-10-11 08:48:39 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2016-10-11 08:48:39 -0400 |
| commit | 332865872846c38b518adc4189ca0aa5eaab1378 (patch) | |
| tree | 300a896aa4d2e897a53db4e8be78d1fbc20d02db | |
| parent | 4f169a020ac80411731dffb3b1ca79e09a3d7541 (diff) | |
| parent | e59f0d4cb964387c5c653d3943ae4ecb9cab55b9 (diff) | |
| download | tor-332865872846c38b518adc4189ca0aa5eaab1378.tar.gz tor-332865872846c38b518adc4189ca0aa5eaab1378.zip | |
Merge remote-tracking branch 'asn/bug19223'
| -rw-r--r-- | changes/bug19223 | 4 | ||||
| -rw-r--r-- | src/or/routerkeys.c | 4 |
2 files changed, 6 insertions, 2 deletions
diff --git a/changes/bug19223 b/changes/bug19223 new file mode 100644 index 0000000000..e8ca6d4ec7 --- /dev/null +++ b/changes/bug19223 @@ -0,0 +1,4 @@ + o Minor bugfixes (getpass): + - Defensively fix a non-triggerable heap corruption at do_getpass() tow + protect ourselves from mistakes in the future. Fixes bug #19223; bugfix + on 0.2.7.3-rc. Bug found by Guido Vranken, patch by nherring.
\ No newline at end of file diff --git a/src/or/routerkeys.c b/src/or/routerkeys.c index 060ffd8753..d5e7051296 100644 --- a/src/or/routerkeys.c +++ b/src/or/routerkeys.c @@ -48,8 +48,8 @@ do_getpass(const char *prompt, char *buf, size_t buflen, size_t p2len = strlen(prompt) + 1; if (p2len < sizeof(msg)) p2len = sizeof(msg); - prompt2 = tor_malloc(strlen(prompt)+1); - memset(prompt2, ' ', p2len); + prompt2 = tor_malloc(p2len); + memset(prompt2, ' ', p2len - sizeof(msg)); memcpy(prompt2 + p2len - sizeof(msg), msg, sizeof(msg)); buf2 = tor_malloc_zero(buflen); |