diff options
| author | Sebastian Hahn <sebastian@torproject.org> | 2015-02-09 04:48:16 +0100 |
|---|---|---|
| committer | Sebastian Hahn <sebastian@torproject.org> | 2015-02-09 04:48:16 +0100 |
| commit | 37d16c3cc78151daf2cbebd643ea4d64b504989e (patch) | |
| tree | b10459934783843ef3e1038f5e4ddf312a7942c3 /src/or | |
| parent | b101f4e98ce811aee729c31f62ec5dd1cfe44e85 (diff) | |
| download | tor-37d16c3cc78151daf2cbebd643ea4d64b504989e.tar.gz tor-37d16c3cc78151daf2cbebd643ea4d64b504989e.zip | |
Reserve enough space for rend_service_port_config_t
In #14803, Damian noticed that his Tor sometimes segfaults. Roger noted
that his valgrind gave an invalid write of size one here. Whenever we
use FLEXIBLE_ARRAY_MEMBER, we have to make sure to actually malloc a
thing that's large enough.
Fixes bug #14803, not in any released version of Tor.
Diffstat (limited to 'src/or')
| -rw-r--r-- | src/or/rendservice.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 6ae569cd8f..6c934c8c12 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -314,7 +314,7 @@ static rend_service_port_config_t * rend_service_port_config_new(const char *socket_path) { if (!socket_path) - return tor_malloc_zero(sizeof(rend_service_port_config_t)); + return tor_malloc_zero(sizeof(rend_service_port_config_t) + 1); const size_t pathlen = strlen(socket_path) + 1; rend_service_port_config_t *conf = |