diff options
| author | Nick Mathewson <nickm@torproject.org> | 2017-11-05 12:21:16 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2017-11-06 12:59:11 -0500 |
| commit | 5240afa713581a0bbba64547e00107a9cbf17f21 (patch) | |
| tree | 4ebafaad43b03fc60c840478e8fa43dc9043d123 /changes | |
| parent | 0386280487fce78b73e060234f515b850af9c589 (diff) | |
| download | tor-5240afa713581a0bbba64547e00107a9cbf17f21.tar.gz tor-5240afa713581a0bbba64547e00107a9cbf17f21.zip | |
Fix a memory leak on decryption non-failure of v3 hsdesc
If it decrypts something that turns out to start with a NUL byte,
then decrypt_desc_layer() will return 0 to indicate the length of
its result. But 0 also indicates an error, which causes the result
not to be freed by decrypt_desc_layer()'s callers.
Since we're trying to stabilize 0.3.2.x, I've opted for the simpler
possible fix here and made it so that an empty decrypted string will
also count as an error.
Fixes bug 24150 and OSS-Fuzz issue 3994.
The original bug was present but unreachable in 0.3.1.1-alpha. I'm
calling this a bugfix on 0.3.2.1-alpha since that's the first version
where you could actually try to decrypt these descriptors.
Diffstat (limited to 'changes')
| -rw-r--r-- | changes/bug24150 | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/changes/bug24150 b/changes/bug24150 new file mode 100644 index 0000000000..cfda7c40da --- /dev/null +++ b/changes/bug24150 @@ -0,0 +1,4 @@ + o Minor bugfixes (v3 onion services): + - Fix a memory leak when decrypting a badly formatted v3 onion + service descriptor. Fixes bug 24150; bugfix on 0.3.2.1-alpha. + Found by OSS-Fuzz; this is OSS-Fuzz issue 3994. |