diff options
| author | Nick Mathewson <nickm@torproject.org> | 2011-01-13 14:36:41 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2011-01-15 11:49:25 -0500 |
| commit | 115782bdbe42e4b3d5cb386d2939a883bc381d12 (patch) | |
| tree | facebd78bfcd426d3404999e5237c502fb34ebaa /src/or/onion.c | |
| parent | a16902b9d4b0a912eb0a252bb945cbeaaa40dacb (diff) | |
| download | tor-115782bdbe42e4b3d5cb386d2939a883bc381d12.tar.gz tor-115782bdbe42e4b3d5cb386d2939a883bc381d12.zip | |
Fix a heap overflow found by debuger, and make it harder to make that mistake again
Our public key functions assumed that they were always writing into a
large enough buffer. In one case, they weren't.
(Incorporates fixes from sebastian)
Diffstat (limited to 'src/or/onion.c')
| -rw-r--r-- | src/or/onion.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/or/onion.c b/src/or/onion.c index 45c75b0717..bf72b4cab1 100644 --- a/src/or/onion.c +++ b/src/or/onion.c @@ -188,6 +188,7 @@ onion_skin_create(crypto_pk_env_t *dest_router_key, /* set meeting point, meeting cookie, etc here. Leave zero for now. */ if (crypto_pk_public_hybrid_encrypt(dest_router_key, onion_skin_out, + ONIONSKIN_CHALLENGE_LEN, challenge, DH_KEY_LEN, PK_PKCS1_OAEP_PADDING, 1)<0) goto err; @@ -230,6 +231,7 @@ onion_skin_server_handshake(const char *onion_skin, /*ONIONSKIN_CHALLENGE_LEN*/ break; note_crypto_pk_op(DEC_ONIONSKIN); len = crypto_pk_private_hybrid_decrypt(k, challenge, + ONIONSKIN_CHALLENGE_LEN, onion_skin, ONIONSKIN_CHALLENGE_LEN, PK_PKCS1_OAEP_PADDING,0); if (len>0) |