From d5161ab895b9c14a66a08fb38521dd12c0772a97 Mon Sep 17 00:00:00 2001 From: Dan Rosenberg Date: Sun, 6 Nov 2011 17:23:14 +0100 Subject: [PATCH 1/2] Fix remotely triggerable assert during ip decryption Fixes bug 4410. --- src/or/routerparse.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 19f9e38a9a..843fc79c82 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3858,6 +3858,11 @@ rend_decrypt_introduction_points(char **ipos_decrypted, crypto_cipher_env_t *cipher; char *dec; int declen; + if (ipos_encrypted_size < CIPHER_IV_LEN + 2) { + log_warn(LD_REND, "Size of encrypted introduction points is too " + "small."); + return -1; + } dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1); cipher = crypto_create_init_cipher(descriptor_cookie, 0); declen = crypto_cipher_decrypt_with_iv(cipher, dec, From be6928d6e78a47800a96962403efff753ad70e84 Mon Sep 17 00:00:00 2001 From: Sebastian Hahn Date: Sun, 6 Nov 2011 17:24:09 +0100 Subject: [PATCH 2/2] Add a changes file for 4410 --- changes/bug4410 | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 changes/bug4410 diff --git a/changes/bug4410 b/changes/bug4410 new file mode 100644 index 0000000000..f42893adf4 --- /dev/null +++ b/changes/bug4410 @@ -0,0 +1,5 @@ + o Major bugfixes: + - Correctly sanity-check that we don't underflow on a memory allocation + for introduction point decryption. Bug discovered by Dan Rosenberg. + Fixes bug 4410; bugfix on 0.2.1.5-alpha. +