From aa45e8259368c9733e459dc4f91f62492b9926da Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Mon, 10 Jan 2011 17:24:16 -0500 Subject: Pull up more data when parsing socks messages Previously, we only looked at up to 128 bytes. This is a bad idea since socks messages can be at least 256+x bytes long. Now we look at up to 512 bytes; this should be enough for 0.2.2.x to handle all valid SOCKS messages. For 0.2.3.x, we can think about handling trickier cases. Fixes 2330. Bugfix on 0.2.0.16-alpha. --- src/or/buffers.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'src/or') diff --git a/src/or/buffers.c b/src/or/buffers.c index 2a88382501..de0c219e85 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -1336,6 +1336,10 @@ log_unsafe_socks_warning(int socks_protocol, const char *address, socks_protocol, address, (int)port); } +/** Do not attempt to parse socks messages longer than this. This value is + * actually significantly higher than the longest possible socks message. */ +#define MAX_SOCKS_MESSAGE_LEN 512 + /** There is a (possibly incomplete) socks handshake on buf, of one * of the forms * - socks4: "socksheader username\\0" @@ -1377,7 +1381,7 @@ fetch_from_buf_socks(buf_t *buf, socks_request_t *req, if (buf->datalen < 2) /* version and another byte */ return 0; - buf_pullup(buf, 128, 0); + buf_pullup(buf, MAX_SOCKS_MESSAGE_LEN, 0); tor_assert(buf->head && buf->head->datalen >= 2); socksver = *buf->head->data; -- cgit v1.2.3-54-g00ecf