diff options
| author | Nick Mathewson <nickm@torproject.org> | 2017-11-13 11:19:09 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2017-11-13 11:19:09 -0500 |
| commit | cf1e6ad2d72696bc788b02c0f51581361f271d67 (patch) | |
| tree | 371524ee86ff1266006f49255c98896e6b778bd0 | |
| parent | 6f9ab69b6dbaf99d7dedaa5714b2fc69e51120ca (diff) | |
| parent | a7ca71cf6b2fb46b049442569188ce046cfd6c34 (diff) | |
| download | tor-cf1e6ad2d72696bc788b02c0f51581361f271d67.tar.gz tor-cf1e6ad2d72696bc788b02c0f51581361f271d67.zip | |
Merge branch 'bug24247_032' into maint-0.3.2
| -rw-r--r-- | changes/bug24247 | 6 | ||||
| -rw-r--r-- | src/test/fuzz/fuzzing_common.c | 5 |
2 files changed, 9 insertions, 2 deletions
diff --git a/changes/bug24247 b/changes/bug24247 new file mode 100644 index 0000000000..1f4ddcdde2 --- /dev/null +++ b/changes/bug24247 @@ -0,0 +1,6 @@ + o Minor bugfixes (fuzzing): + - Fix a bug in our fuzzing mock replacement for crypto_pk_checksig(), to + correctly handle cases where a caller gives it an RSA key of under 160 + bits. (This is not actually a bug in Tor itself, but wrather in our + fuzzing code.) Fixes bug 24247; bugfix on 0.3.0.3-alpha. + Found by OSS-Fuzz as issue 4177. diff --git a/src/test/fuzz/fuzzing_common.c b/src/test/fuzz/fuzzing_common.c index 7ebddde1a8..1e98eb6c85 100644 --- a/src/test/fuzz/fuzzing_common.c +++ b/src/test/fuzz/fuzzing_common.c @@ -28,8 +28,9 @@ mock_crypto_pk_public_checksig__nocheck(const crypto_pk_t *env, char *to, (void)fromlen; /* We could look at from[0..fromlen-1] ... */ tor_assert(tolen >= crypto_pk_keysize(env)); - memset(to, 0x01, 20); - return 20; + size_t siglen = MIN(20, crypto_pk_keysize(env)); + memset(to, 0x01, siglen); + return (int)siglen; } static int |