diff options
| -rw-r--r-- | changes/bug19281 | 5 | ||||
| -rw-r--r-- | src/or/control.c | 20 |
2 files changed, 19 insertions, 6 deletions
diff --git a/changes/bug19281 b/changes/bug19281 new file mode 100644 index 0000000000..1586ba34f3 --- /dev/null +++ b/changes/bug19281 @@ -0,0 +1,5 @@ + o Minor bugfixes (correctness, controller): + - Make the controller's write_escaped_data() function robust to extremely + long inputs. Right now, it doesn't actually receive any extremely + long inputs, so this is for defense in depth. Fixes bug 19281; + bugfix on 0.1.1.1-alpha. Reported by Guido Vranken. diff --git a/src/or/control.c b/src/or/control.c index 2ff1cc8442..4df670cd27 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -313,16 +313,23 @@ connection_write_str_to_buf(const char *s, control_connection_t *conn) STATIC size_t write_escaped_data(const char *data, size_t len, char **out) { - size_t sz_out = len+8; + tor_assert(len < SIZE_MAX - 9); + size_t sz_out = len+8+1; char *outp; const char *start = data, *end; - int i; + size_t i; int start_of_line; - for (i=0; i<(int)len; ++i) { - if (data[i]== '\n') + for (i=0; i < len; ++i) { + if (data[i] == '\n') { sz_out += 2; /* Maybe add a CR; maybe add a dot. */ + if (sz_out >= SIZE_T_CEILING) { + log_warn(LD_BUG, "Input to write_escaped_data was too long"); + *out = tor_strdup(".\r\n"); + return 3; + } + } } - *out = outp = tor_malloc(sz_out+1); + *out = outp = tor_malloc(sz_out); end = data+len; start_of_line = 1; while (data < end) { @@ -348,7 +355,8 @@ write_escaped_data(const char *data, size_t len, char **out) *outp++ = '\r'; *outp++ = '\n'; *outp = '\0'; /* NUL-terminate just in case. */ - tor_assert((outp - *out) <= (int)sz_out); + tor_assert(outp >= *out); + tor_assert((size_t)(outp - *out) <= sz_out); return outp - *out; } |