diff options
| author | David Goulet <dgoulet@torproject.org> | 2017-06-05 09:35:03 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2017-06-08 09:14:10 -0400 |
| commit | 79b59a2dfcb68897ee89d98587d09e55f07e68d7 (patch) | |
| tree | f789ed76c179bd52756eb3cbc7dad91150e7a933 /changes | |
| parent | 68c3df69dec4b2b9b5276f7cc9f86ef4167fc705 (diff) | |
| download | tor-79b59a2dfcb68897ee89d98587d09e55f07e68d7.tar.gz tor-79b59a2dfcb68897ee89d98587d09e55f07e68d7.zip | |
TROVE-2017-004: Fix assertion failure in relay_send_end_cell_from_edge_
This fixes an assertion failure in relay_send_end_cell_from_edge_() when an
origin circuit and a cpath_layer = NULL were passed.
A service rendezvous circuit could do such a thing when a malformed BEGIN cell
is received but shouldn't in the first place because the service needs to send
an END cell on the circuit for which it can not do without a cpath_layer.
Fixes #22493
Reported-by: Roger Dingledine <arma@torproject.org>
Signed-off-by: David Goulet <dgoulet@torproject.org>
Diffstat (limited to 'changes')
| -rw-r--r-- | changes/trove-2017-004 | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/changes/trove-2017-004 b/changes/trove-2017-004 new file mode 100644 index 0000000000..106d3afcb5 --- /dev/null +++ b/changes/trove-2017-004 @@ -0,0 +1,5 @@ + o Major bugfixes (hidden service, relay): + - Fix an assertion failure when an hidden service handles a malformed + BEGIN cell. This bug resulted in the service crashing triggered by a + tor_assert(). Part of TROVE-2017-004. Fixes bug 22493; bugfix on + tor-0.3.0.1-alpha. Found by armadev. |