diff options
| author | George Kadianakis <desnacked@riseup.net> | 2016-10-10 12:03:39 -0400 |
|---|---|---|
| committer | George Kadianakis <desnacked@riseup.net> | 2016-10-10 12:03:39 -0400 |
| commit | e59f0d4cb964387c5c653d3943ae4ecb9cab55b9 (patch) | |
| tree | ea77ddbe7b8160d752557316f963b7a3236b1368 /src/or | |
| parent | 684500519d5060fcbcc410a0e71d8d9a32fa8220 (diff) | |
| download | tor-e59f0d4cb964387c5c653d3943ae4ecb9cab55b9.tar.gz tor-e59f0d4cb964387c5c653d3943ae4ecb9cab55b9.zip | |
Fix non-triggerable heap corruption at do_getpass().
Diffstat (limited to 'src/or')
| -rw-r--r-- | src/or/routerkeys.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/or/routerkeys.c b/src/or/routerkeys.c index 060ffd8753..d5e7051296 100644 --- a/src/or/routerkeys.c +++ b/src/or/routerkeys.c @@ -48,8 +48,8 @@ do_getpass(const char *prompt, char *buf, size_t buflen, size_t p2len = strlen(prompt) + 1; if (p2len < sizeof(msg)) p2len = sizeof(msg); - prompt2 = tor_malloc(strlen(prompt)+1); - memset(prompt2, ' ', p2len); + prompt2 = tor_malloc(p2len); + memset(prompt2, ' ', p2len - sizeof(msg)); memcpy(prompt2 + p2len - sizeof(msg), msg, sizeof(msg)); buf2 = tor_malloc_zero(buflen); |