From 49ddd92c115c6943c4602d44f52c22b6f47698e8 Mon Sep 17 00:00:00 2001
From: Yawning Angel <yawning@schwanenlied.me>
Date: Mon, 30 Mar 2015 21:53:39 +0000
Subject: Validate the RSA key size received when parsing INTRODUCE2 cells.

Fixes bug 15600; reported by skruffy
---
 src/or/rendservice.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'src')

diff --git a/src/or/rendservice.c b/src/or/rendservice.c
index 8a4a11e475..436f2f4b69 100644
--- a/src/or/rendservice.c
+++ b/src/or/rendservice.c
@@ -1810,6 +1810,16 @@ rend_service_parse_intro_for_v2(
 
     goto err;
   }
+  if (128 != crypto_pk_keysize(extend_info->onion_key)) {
+    if (err_msg_out) {
+      tor_asprintf(err_msg_out,
+                   "invalid onion key size in version %d INTRODUCE%d cell",
+                   intro->version,
+                   (intro->type));
+    }
+
+    goto err;
+  }
 
   ver_specific_len = 7+DIGEST_LEN+2+klen;
 
-- 
cgit v1.2.3-54-g00ecf