diff options
| author | Nick Mathewson <nickm@torproject.org> | 2021-03-15 08:58:54 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2021-03-15 08:58:54 -0400 |
| commit | f078aab71ef56e1942caec5f27e0f336f2a7c7d1 (patch) | |
| tree | e1f5f28cfbc9e2b01d51303fa2cd79e26f9b52d5 | |
| parent | efca9ce41c96bb0044f504ced36a2734b1689ee2 (diff) | |
| parent | 890ae4fb1adfa13e37aaf5261e089e8c195a75cf (diff) | |
| download | tor-f078aab71ef56e1942caec5f27e0f336f2a7c7d1.tar.gz tor-f078aab71ef56e1942caec5f27e0f336f2a7c7d1.zip | |
Merge branch 'bug40316_035_v2' into maint-0.3.5
| -rw-r--r-- | changes/bug40316 | 5 | ||||
| -rw-r--r-- | src/feature/dirauth/dirvote.c | 2 |
2 files changed, 6 insertions, 1 deletions
diff --git a/changes/bug40316 b/changes/bug40316 new file mode 100644 index 0000000000..cd275b5c9c --- /dev/null +++ b/changes/bug40316 @@ -0,0 +1,5 @@ + o Major bugfixes (security, denial of service): + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. + Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as + TROVE-2021-002 and CVE-2021-28090. diff --git a/src/feature/dirauth/dirvote.c b/src/feature/dirauth/dirvote.c index af8b3dc207..9e01cee42a 100644 --- a/src/feature/dirauth/dirvote.c +++ b/src/feature/dirauth/dirvote.c @@ -3520,7 +3520,7 @@ dirvote_add_signatures_to_pending_consensus( strlen(pc->body) + strlen(new_signatures) + 1; pc->body = tor_realloc(pc->body, new_consensus_len); dst_end = pc->body + new_consensus_len; - dst = strstr(pc->body, "directory-signature "); + dst = (char *) find_str_at_start_of_line(pc->body, "directory-signature "); tor_assert(dst); strlcpy(dst, new_signatures, dst_end-dst); |