diff options
| author | Nick Mathewson <nickm@torproject.org> | 2007-07-12 16:17:31 +0000 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2007-07-12 16:17:31 +0000 |
| commit | 588a007b8af5e5a734845da38ae4f1ed18b480e7 (patch) | |
| tree | d9352e84807c3b06fbadcbd3136910795c721db7 /src | |
| parent | d6f01a37c6086fe2d3ce2f0e2539a04ba3fc9833 (diff) | |
| download | tor-588a007b8af5e5a734845da38ae4f1ed18b480e7.tar.gz tor-588a007b8af5e5a734845da38ae4f1ed18b480e7.zip | |
r13718@catbus: nickm | 2007-07-12 12:16:49 -0400
Backport r10760: fix possible buffer overrun in natd code used by old BSDs.
svn:r10811
Diffstat (limited to 'src')
| -rw-r--r-- | src/or/connection_edge.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index cf34952f90..644ed54b64 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1685,10 +1685,14 @@ connection_ap_process_natd(edge_connection_t *conn) } daddr = tbuf = &tmp_buf[0] + 6; /* after end of "[DEST " */ - while (*tbuf != '\0' && *tbuf != ' ') - tbuf++; - *tbuf = '\0'; - tbuf++; + if (!(tbuf = strchr(tbuf, ' '))) { + log_warn(LD_APP,"Natd handshake was ill-formed; closing. The client " + "said: %s", + escaped(tmp_buf)); + connection_mark_unattached_ap(conn, END_STREAM_REASON_INVALID_NATD_DEST); + return -1; + } + *tbuf++ = '\0'; /* pretend that a socks handshake completed so we don't try to * send a socks reply down a natd conn */ |