diff options
| author | cypherpunks <cypherpunks@torproject.org> | 2020-03-03 07:01:05 +0000 |
|---|---|---|
| committer | cypherpunks <cypherpunks@torproject.org> | 2020-03-24 05:19:24 +0000 |
| commit | fd3e0c154236c59c2972b549500675980bb02507 (patch) | |
| tree | d2b0fede6c65721d2976a612fa61ee613790dd68 /changes/bug33131 | |
| parent | b9c7c61ea5233854ff83257a8bc530b7e0a50351 (diff) | |
| download | tor-fd3e0c154236c59c2972b549500675980bb02507.tar.gz tor-fd3e0c154236c59c2972b549500675980bb02507.zip | |
core/mainloop: Limit growth of conn->inbuf
If the buf_t's length could potentially become greater than INT_MAX - 1,
it sets off an IF_BUG_ONCE in buf_read_from_tls().
All of the rest of the buffers.c code has similar BUG/asserts for this
invariant.
Diffstat (limited to 'changes/bug33131')
| -rw-r--r-- | changes/bug33131 | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/changes/bug33131 b/changes/bug33131 new file mode 100644 index 0000000000..bc5ef7bc2d --- /dev/null +++ b/changes/bug33131 @@ -0,0 +1,3 @@ + o Minor bugfixes (mainloop): + - Better guard against growing a buffer past its maximum 2GB in size. + Fixes bug 33131; bugfix on 0.3.0.4-rc. |