From a7ca71cf6b2fb46b049442569188ce046cfd6c34 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Sat, 11 Nov 2017 14:42:39 -0500 Subject: Fix mock_crypto_pk_public_checksig__nocheck() to handle short RSA keys This function -- a mock replacement used only for fuzzing -- would have a buffer overflow if it got an RSA key whose modulus was under 20 bytes long. Fortunately, Tor itself does not appear to have a bug here. Fixes bug 24247; bugfix on 0.3.0.3-alpha when fuzzing was introduced. Found by OSS-Fuzz; this is OSS-Fuzz issue 4177. --- src/test/fuzz/fuzzing_common.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'src/test') diff --git a/src/test/fuzz/fuzzing_common.c b/src/test/fuzz/fuzzing_common.c index 7ebddde1a8..1e98eb6c85 100644 --- a/src/test/fuzz/fuzzing_common.c +++ b/src/test/fuzz/fuzzing_common.c @@ -28,8 +28,9 @@ mock_crypto_pk_public_checksig__nocheck(const crypto_pk_t *env, char *to, (void)fromlen; /* We could look at from[0..fromlen-1] ... */ tor_assert(tolen >= crypto_pk_keysize(env)); - memset(to, 0x01, 20); - return 20; + size_t siglen = MIN(20, crypto_pk_keysize(env)); + memset(to, 0x01, siglen); + return (int)siglen; } static int -- cgit v1.2.3-54-g00ecf