From d2e9d1713487c5ae63ef453a11343470c1d54330 Mon Sep 17 00:00:00 2001 From: George Kadianakis Date: Mon, 7 May 2012 18:05:54 +0300 Subject: [PATCH 1/2] Reorder rend_mid_rendezvous() to do protocol violation checks on top. --- changes/bug5645 | 5 +++++ src/or/rendmid.c | 13 ++++++------- 2 files changed, 11 insertions(+), 7 deletions(-) create mode 100644 changes/bug5645 diff --git a/changes/bug5645 b/changes/bug5645 new file mode 100644 index 0000000000..0abd3b1a21 --- /dev/null +++ b/changes/bug5645 @@ -0,0 +1,5 @@ + o Code refactoring: + - Defensively refactor rend_mid_rendezvous() so that protocol + violations and length checks happen in the beginning. Fixes bug + 5645. + diff --git a/src/or/rendmid.c b/src/or/rendmid.c index 2742c351b3..391eab7f82 100644 --- a/src/or/rendmid.c +++ b/src/or/rendmid.c @@ -276,13 +276,6 @@ rend_mid_rendezvous(or_circuit_t *circ, const uint8_t *request, or_circuit_t *rend_circ; char hexid[9]; int reason = END_CIRC_REASON_INTERNAL; - base16_encode(hexid,9,(char*)request,request_len<4?request_len:4); - - if (request_len>=4) { - log_info(LD_REND, - "Got request for rendezvous from circuit %d to cookie %s.", - circ->p_circ_id, hexid); - } if (circ->_base.purpose != CIRCUIT_PURPOSE_OR || circ->_base.n_conn) { log_info(LD_REND, @@ -300,6 +293,12 @@ rend_mid_rendezvous(or_circuit_t *circ, const uint8_t *request, goto err; } + base16_encode(hexid, 9, (char*)request, 4); + + log_info(LD_REND, + "Got request for rendezvous from circuit %d to cookie %s.", + circ->p_circ_id, hexid); + rend_circ = circuit_get_rendezvous((char*)request); if (!rend_circ) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, From f84f75c59c6b06fbef41f0f0641b604cf3192eeb Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Mon, 7 May 2012 11:09:02 -0400 Subject: [PATCH 2/2] Make a cast less const-violating; make a field size explicit. --- src/or/rendmid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/rendmid.c b/src/or/rendmid.c index 391eab7f82..894bbb3c54 100644 --- a/src/or/rendmid.c +++ b/src/or/rendmid.c @@ -293,7 +293,7 @@ rend_mid_rendezvous(or_circuit_t *circ, const uint8_t *request, goto err; } - base16_encode(hexid, 9, (char*)request, 4); + base16_encode(hexid, sizeof(hexid), (const char*)request, 4); log_info(LD_REND, "Got request for rendezvous from circuit %d to cookie %s.",