diff options
author | Nick Mathewson <nickm@torproject.org> | 2017-06-08 09:21:15 -0400 |
---|---|---|
committer | Nick Mathewson <nickm@torproject.org> | 2017-06-08 09:21:15 -0400 |
commit | d15d09a96839e0c13a9b9845a51a402d7a931949 (patch) | |
tree | ba7ddd844dd7480ebf6e318d39f73edfdf20a7c8 | |
parent | d850d27369020706769e9e8a0d5fec621a5deb8a (diff) | |
parent | c1646d6e894f11fe3a363468d7a668648f2d63d7 (diff) | |
download | tor-d15d09a96839e0c13a9b9845a51a402d7a931949.tar.gz tor-d15d09a96839e0c13a9b9845a51a402d7a931949.zip |
Merge branch 'maint-0.2.7-redux' into maint-0.2.8
-rw-r--r-- | changes/trove-2017-005 | 7 | ||||
-rw-r--r-- | src/or/relay.c | 3 |
2 files changed, 9 insertions, 1 deletions
diff --git a/changes/trove-2017-005 b/changes/trove-2017-005 new file mode 100644 index 0000000000..cebb013f86 --- /dev/null +++ b/changes/trove-2017-005 @@ -0,0 +1,7 @@ + o Major bugfixes (hidden service, relay, security): + - Fix an assertion failure caused by receiving a BEGIN_DIR cell on + a hidden service rendezvous circuit. Fixes bug 22494, tracked as + TROVE-2017-005 and CVE-2017-0376; bugfix on 0.2.2.1-alpha. Found + by armadev. + + diff --git a/src/or/relay.c b/src/or/relay.c index 3f7751826c..9cd68cc440 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1499,7 +1499,8 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "Begin cell for known stream. Dropping."); return 0; } - if (rh.command == RELAY_COMMAND_BEGIN_DIR) { + if (rh.command == RELAY_COMMAND_BEGIN_DIR && + circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) { /* Assign this circuit and its app-ward OR connection a unique ID, * so that we can measure download times. The local edge and dir * connection will be assigned the same ID when they are created |