diff options
| -rw-r--r-- | changes/md_leak_bug | 5 | ||||
| -rw-r--r-- | src/or/routerparse.c | 2 |
2 files changed, 7 insertions, 0 deletions
diff --git a/changes/md_leak_bug b/changes/md_leak_bug new file mode 100644 index 0000000000..26270aacc3 --- /dev/null +++ b/changes/md_leak_bug @@ -0,0 +1,5 @@ + o Major bugfixes (security, OOM) + - Fix a memory leak that could occur if a microdescriptor parse + fails during the tokenizing step. This could enable a memory + exhaustion attack by directory servers. Fixes bug #11649; bugfix + on 0.2.2.6-alpha. diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 97e0bc8c85..3ff887c3ca 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -4455,11 +4455,13 @@ microdescs_parse_from_string(const char *s, const char *eos, microdesc_free(md); md = NULL; + SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_clear(t)); memarea_clear(area); smartlist_clear(tokens); s = start_of_next_microdesc; } + SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_clear(t)); memarea_drop_all(area); smartlist_free(tokens); |