torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

circpad_setup_machine_on_circ(): exit early on error.

Browse Source 
This function does a nonfatal assertion to make sure that a machine
is not registered twice, but Tobias Pulls found a case where it
happens.  Instead, make the function exit early so that it doesn't
cause a remotely triggered memory leak.

Fixes bug 33619; bugfix on 0.4.0.1-alpha.  This is also tracked as
TROVE-2020-004.
This commit is contained in:
Nick Mathewson
2020-03-14 14:44:33 -04:00
parent 7a9e2a261b
commit 78bcfc1280
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/ticket33619
+5
View File
@@ -0,0 +1,5 @@
o Major bugfixes (circuit padding, memory leaks):
- Avoid a remotely triggered memory leak in the case that a circuit
padding machine is somehow negotiated twice on the same circuit. Fixes
bug 33619; bugfix on 0.4.0.1-alpha. Found by Tobias Pulls. This is
also tracked as TROVE-2020-004.
src/core/or/circuitpadding.c
+6 -3
View File
@@ -2381,9 +2381,12 @@ circpad_setup_machine_on_circ(circuit_t *on_circ,
return;
}
tor_assert_nonfatal(on_circ->padding_machine[machine->machine_index]
== NULL);
tor_assert_nonfatal(on_circ->padding_info[machine->machine_index] == NULL);
IF_BUG_ONCE(on_circ->padding_machine[machine->machine_index] != NULL) {
return;
}
IF_BUG_ONCE(on_circ->padding_info[machine->machine_index] != NULL) {
return;
}
/* Log message */
if (CIRCUIT_IS_ORIGIN(on_circ)) {