diff options
| author | Nick Mathewson <nickm@torproject.org> | 2016-12-18 20:13:58 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2016-12-18 20:17:24 -0500 |
| commit | d978216dea6b21ac38230a59d172139185a68dbd (patch) | |
| tree | 07f527c928e9afabc31aed646816e9462e704d0e /changes | |
| parent | 9db47e792160766de49b76bff71afdc4f743df88 (diff) | |
| download | tor-d978216dea6b21ac38230a59d172139185a68dbd.tar.gz tor-d978216dea6b21ac38230a59d172139185a68dbd.zip | |
Fix parsing bug with unecognized token at EOS
In get_token(), we could read one byte past the end of the
region. This is only a big problem in the case where the region
itself is (a) potentially hostile, and (b) not explicitly
nul-terminated.
This patch fixes the underlying bug, and also makes sure that the
one remaining case of not-NUL-terminated potentially hostile data
gets NUL-terminated.
Fix for bug 21018, TROVE-2016-12-002, and CVE-2016-1254
Diffstat (limited to 'changes')
| -rw-r--r-- | changes/bug21018 | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/changes/bug21018 b/changes/bug21018 new file mode 100644 index 0000000000..49a8b47a25 --- /dev/null +++ b/changes/bug21018 @@ -0,0 +1,11 @@ + o Major bugfixes (parsing, security): + + - Fix a bug in parsing that could cause clients to read a single + byte past the end of an allocated region. This bug could be + used to cause hardened clients (built with + --enable-expensive-hardening) to crash if they tried to visit + a hostile hidden service. Non-hardened clients are only + affected depending on the details of their platform's memory + allocator. Fixes bug 21018; bugfix on 0.2.0.8-alpha. Found by + using libFuzzer. Also tracked as TROVE-2016-12-002 and as + CVE-2016-1254. |