diff options
| author | Nick Mathewson <nickm@torproject.org> | 2016-12-20 18:11:25 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2016-12-20 18:11:25 -0500 |
| commit | b18bde23cf9c0afc95a83c3bfc7205218add4ddd (patch) | |
| tree | ba5e7e68771c928e10250f75bb6802f0fd777a65 /src/or | |
| parent | 3d9f8ff6a5c37e9f124f8111f904b97f095ca621 (diff) | |
| parent | db58d4d16ff156b8827198b2732646c73eb59f14 (diff) | |
| download | tor-b18bde23cf9c0afc95a83c3bfc7205218add4ddd.tar.gz tor-b18bde23cf9c0afc95a83c3bfc7205218add4ddd.zip | |
Merge branch 'maint-0.2.5' into maint-0.2.6
Diffstat (limited to 'src/or')
| -rw-r--r-- | src/or/rendcommon.c | 6 | ||||
| -rw-r--r-- | src/or/routerparse.c | 6 |
2 files changed, 7 insertions, 5 deletions
diff --git a/src/or/rendcommon.c b/src/or/rendcommon.c index 6698f2feaf..0451ae62ee 100644 --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@ -1216,8 +1216,10 @@ rend_cache_store_v2_desc_as_client(const char *desc, intro_size); if (n_intro_points <= 0) { log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); + "service has published a corrupt descriptor, or you have " + "provided invalid authorization data, or (maybe!) the " + "server is deliberately serving broken data in an attempt " + "to crash you with bug 21018."); goto err; } else if (n_intro_points > MAX_INTRO_POINTS) { log_warn(LD_REND, "Found too many introduction points on a hidden " diff --git a/src/or/routerparse.c b/src/or/routerparse.c index dcf419798a..22d1a27f39 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3724,7 +3724,7 @@ get_next_token(memarea_t *area, if (tok->tp == ERR_) { /* No keyword matched; call it an "K_opt" or "A_unrecognized" */ - if (**s == '@') + if (*s < eol && **s == '@') tok->tp = A_UNKNOWN_; else tok->tp = K_OPT; @@ -4763,7 +4763,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, crypto_cipher_free(cipher); len = ipos_encrypted_size - 2 - client_entries_len - CIPHER_IV_LEN; - dec = tor_malloc(len); + dec = tor_malloc_zero(len + 1); declen = crypto_cipher_decrypt_with_iv(session_key, dec, len, ipos_encrypted + 2 + client_entries_len, ipos_encrypted_size - 2 - client_entries_len); @@ -4795,7 +4795,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, "small."); return -1; } - dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1); + dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1 + 1); declen = crypto_cipher_decrypt_with_iv(descriptor_cookie, dec, ipos_encrypted_size - |