diff options
| author | Roger Dingledine <arma@mit.edu> | 2009-06-12 11:18:02 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2009-06-12 11:18:02 -0400 |
| commit | cb1617f18e94b244dc0847658e006057040dcc37 (patch) | |
| tree | 2fde225a99244539b3a48bda27bbdd7e4592e1d0 /src/or/relay.c | |
| parent | 77f5ad6b07dcdd3271d56f5e9edde3dc56ffe411 (diff) | |
| download | tor-cb1617f18e94b244dc0847658e006057040dcc37.tar.gz tor-cb1617f18e94b244dc0847658e006057040dcc37.zip | |
Check answer_len in the remap_addr case of process_relay_cell_not_open.
Fix an edge case where a malicious exit relay could convince a
controller that the client's DNS question resolves to an internal IP
address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta.
Diffstat (limited to 'src/or/relay.c')
| -rw-r--r-- | src/or/relay.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/or/relay.c b/src/or/relay.c index 4e09c0040b..e9baac6a45 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -947,7 +947,7 @@ connection_edge_process_relay_cell_not_open( cell->payload+RELAY_HEADER_SIZE+2, /*answer*/ ttl, -1); - if (answer_type == RESOLVED_TYPE_IPV4) { + if (answer_type == RESOLVED_TYPE_IPV4 && answer_len >= 4) { uint32_t addr = ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+2)); remap_event_helper(conn, addr); } |