From 9d0777839be6642954a4c064c819d406d8bb7cb4 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Wed, 14 Dec 2011 16:38:43 -0500 Subject: Add a fix for the buf_pullup bug that Vektor reported --- changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-) create mode 100644 changes/buffer_bug diff --git a/changes/buffer_bug b/changes/buffer_bug new file mode 100644 index 0000000000..634f609533 --- /dev/null +++ b/changes/buffer_bug @@ -0,0 +1,7 @@ + + o Major bugfixes: + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". + diff --git a/src/or/buffers.c b/src/or/buffers.c index 710374638b..5701604909 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -375,9 +375,10 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate) if (buf->head->memlen >= capacity) { /* We don't need to grow the first chunk, but we might need to repack it.*/ - if (CHUNK_REMAINING_CAPACITY(buf->head) < capacity-buf->datalen) + size_t needed = capacity - buf->head->datalen; + if (CHUNK_REMAINING_CAPACITY(buf->head) < needed) chunk_repack(buf->head); - tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= capacity-buf->datalen); + tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= needed); } else { chunk_t *newhead; size_t newsize; -- cgit v1.2.3-54-g00ecf