Pull up more data when parsing socks messages

Previously, we only looked at up to 128 bytes.  This is a bad idea
since socks messages can be at least 256+x bytes long.  Now we look at
up to 512 bytes; this should be enough for 0.2.2.x to handle all valid
SOCKS messages.  For 0.2.3.x, we can think about handling trickier
cases.

Fixes 2330.  Bugfix on 0.2.0.16-alpha.
This commit is contained in:
Nick Mathewson
2011-01-10 17:24:16 -05:00
parent 5ae391762c
commit aa45e82593
2 changed files with 12 additions and 1 deletions
+7
View File
@@ -0,0 +1,7 @@
o Minor bugfixes
- Handle SOCKS messages longer than 128 bytes long correctly, rather
than waiting forever for them to finish. Fixes bug 2330. Bugfix on
0.2.0.16-alpha. Found by doorss.
+5 -1
View File
@@ -1336,6 +1336,10 @@ log_unsafe_socks_warning(int socks_protocol, const char *address,
socks_protocol, address, (int)port);
}
/** Do not attempt to parse socks messages longer than this. This value is
* actually significantly higher than the longest possible socks message. */
#define MAX_SOCKS_MESSAGE_LEN 512
/** There is a (possibly incomplete) socks handshake on <b>buf</b>, of one
* of the forms
* - socks4: "socksheader username\\0"
@@ -1377,7 +1381,7 @@ fetch_from_buf_socks(buf_t *buf, socks_request_t *req,
if (buf->datalen < 2) /* version and another byte */
return 0;
buf_pullup(buf, 128, 0);
buf_pullup(buf, MAX_SOCKS_MESSAGE_LEN, 0);
tor_assert(buf->head && buf->head->datalen >= 2);
socksver = *buf->head->data;