From 71862ed76325a97025339ea9348e2f527a4eb940 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Tue, 25 Jan 2011 17:15:22 -0500 Subject: [PATCH 1/2] Fix bug in verifying directory signatures with short digests If we got a signed digest that was shorter than the required digest length, but longer than 20 bytes, we would accept it as long enough.... and then immediately fail when we want to check it. Fixes bug 2409; bug in 0.2.2.20-alpha; found by piebeer. --- changes/bug2409 | 4 ++++ src/or/routerparse.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 changes/bug2409 diff --git a/changes/bug2409 b/changes/bug2409 new file mode 100644 index 0000000000..5523458b64 --- /dev/null +++ b/changes/bug2409 @@ -0,0 +1,4 @@ + o Minor bugfixes + - Resolve a bug in verifying signatures of directory objects + with digests longer than SHA1. Bugfix on 0.2.2.20-alpha; + fixes bug 2409; found by "piebeer". diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 5ceb298b8b..db7161e3da 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -1088,7 +1088,7 @@ check_signature_token(const char *digest, signed_digest = tor_malloc(keysize); if (crypto_pk_public_checksig(pkey, signed_digest, keysize, tok->object_body, tok->object_size) - < DIGEST_LEN) { + < digest_len) { log_warn(LD_DIR, "Error reading %s: invalid signature.", doctype); tor_free(signed_digest); return -1; From 9a4b2ec764de7ff49931a4ea561febada728d9b3 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Tue, 25 Jan 2011 17:27:25 -0500 Subject: [PATCH 2/2] Avoid sketchy integer cast in cbt code When calling circuit_build_times_shuffle_and_store_array, we were passing a uint32_t as an int. arma is pretty sure that this can't actually cause a bug, because of checks elsewhere in the code, but it's best not to pass a uint32_t as an int anyway. Found by doorss; fix on 0.2.2.4-alpha. --- src/or/circuitbuild.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 3788959556..5c9c1acf25 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -588,9 +588,9 @@ circuit_build_times_update_state(circuit_build_times_t *cbt, static void circuit_build_times_shuffle_and_store_array(circuit_build_times_t *cbt, build_time_t *raw_times, - int num_times) + uint32_t num_times) { - int n = num_times; + uint32_t n = num_times; if (num_times > CBT_NCIRCUITS_TO_OBSERVE) { log_notice(LD_CIRC, "Decreasing circuit_build_times size from %d to %d", num_times, CBT_NCIRCUITS_TO_OBSERVE);