diff options
| author | David Goulet <dgoulet@torproject.org> | 2021-03-23 09:19:41 -0400 |
|---|---|---|
| committer | David Goulet <dgoulet@torproject.org> | 2021-03-23 09:19:41 -0400 |
| commit | 9ca2394d6b51242bb5cf380757be5869d2a44c3c (patch) | |
| tree | 9e941698035b90bd0775f1cfbd341178f6a31b6e /changes | |
| parent | 94fb308c5d0f0d76b46b25d5f7c584f2b5a900c3 (diff) | |
| download | tor-9ca2394d6b51242bb5cf380757be5869d2a44c3c.tar.gz tor-9ca2394d6b51242bb5cf380757be5869d2a44c3c.zip | |
channel: Fix use after free in channel_do_open_actions()
Fortunately, our tor_free() is setting the variable to NULL after so we were
in a situation where NULL was always used instead of the transport name.
This first appeared in 894ff2dc8422cb86312c512698acd76476224f87 and results in
basically no bridge with a transport being able to use DoS defenses.
Fixes #40345
Signed-off-by: David Goulet <dgoulet@torproject.org>
Diffstat (limited to 'changes')
| -rw-r--r-- | changes/ticket40345 | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/changes/ticket40345 b/changes/ticket40345 new file mode 100644 index 0000000000..246e4a86af --- /dev/null +++ b/changes/ticket40345 @@ -0,0 +1,5 @@ + o Minor bugfixes (channel, DoS): + - Fix a possible non fatal assertion BUG() due to a too early free of a + string when noting down the client connection for the DoS defenses + subsystem. Fixes bug 40345; bugfix on 0.4.3.4-rc + |