backport 8844: avoid infinite loop on unexpected controller input.

svn:r8849

2 files changed, 3 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 1a13623d8a..54d47f4c6b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,4 @@
-Changes in version 0.1.1.25 - 2006-10-?? [ongoing]
+Changes in version 0.1.1.25 - 2006-11-?? [ongoing]
   o Major bugfixes:
     - When a client asks us to resolve (not connect to) an address,
       and we have a cached answer, give them the cached answer.
@@ -24,6 +24,7 @@ Changes in version 0.1.1.25 - 2006-10-?? [ongoing]
     - Avoid possibility of controller-triggered crash when misusing
       certain commands from a v0 controller on platforms that do not
       handle printf("%s",NULL) gracefully.
+    - Avoid infinite loop on unexpected controller input.
 
 
 Changes in version 0.1.1.24 - 2006-09-29
diff --git a/src/or/buffers.c b/src/or/buffers.c
index f5dd19135b..2098016313 100644
--- a/src/or/buffers.c
+++ b/src/or/buffers.c
@@ -1232,7 +1232,7 @@ find_char_on_buf(buf_t *buf, char *start, size_t len, char c)
   size_t len_rest;
   char *cp;
   _split_range(buf, start, &len, &len_rest);
-  cp = memchr(buf->cur, c, len);
+  cp = memchr(start, c, len);
   if (cp || !len_rest)
     return cp;
   return memchr(buf->mem, c, len_rest);