torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix out-of-bounds write during voting with duplicate ed25519 keys

Browse Source 
In dirserv_compute_performance_thresholds, we allocate arrays based
on the length of 'routers', a list of routerinfo_t, but loop over
the nodelist. The 'routers' list may be shorter when relays were
filtered by routers_make_ed_keys_unique, leading to an out-of-bounds
write on directory authorities.

This bug was originally introduced in 26e89742, but it doesn't look
possible to trigger until routers_make_ed_keys_unique was introduced
in 13a31e72.

Fixes bug 19032; bugfix on tor 0.2.8.2-alpha.
This commit is contained in:
John Brooks
2016-05-11 12:13:22 -04:00
parent 61c0bae4f2
commit bf3e32a452
4 changed files with 22 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/bug19032
+4
View File
@@ -0,0 +1,4 @@
o Major bugfixes (security, directory authorities):
- Fix a crash and out-of-bounds write during authority voting, when the
list of relays includes duplicate ed25519 identity keys. Fixes bug 19032;
bugfix on 0.2.8.2-alpha.