torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

TROVE-2017-004: Fix assertion failure in relay_send_end_cell_from_edge_

Browse Source 
This fixes an assertion failure in relay_send_end_cell_from_edge_() when an
origin circuit and a cpath_layer = NULL were passed.

A service rendezvous circuit could do such a thing when a malformed BEGIN cell
is received but shouldn't in the first place because the service needs to send
an END cell on the circuit for which it can not do without a cpath_layer.

Fixes #22493

Reported-by: Roger Dingledine <arma@torproject.org>
Signed-off-by: David Goulet <dgoulet@torproject.org>
This commit is contained in:
David Goulet
2017-06-05 09:35:03 -04:00
committed by Nick Mathewson
parent 68c3df69de
commit 79b59a2dfc
2 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/trove-2017-004
+5
View File
@@ -0,0 +1,5 @@
o Major bugfixes (hidden service, relay):
- Fix an assertion failure when an hidden service handles a malformed
BEGIN cell. This bug resulted in the service crashing triggered by a
tor_assert(). Part of TROVE-2017-004. Fixes bug 22493; bugfix on
tor-0.3.0.1-alpha. Found by armadev.