mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-12-06 19:41:15 +01:00
Fix out-of-bounds write during voting with duplicate ed25519 keys
In dirserv_compute_performance_thresholds, we allocate arrays based on the length of 'routers', a list of routerinfo_t, but loop over the nodelist. The 'routers' list may be shorter when relays were filtered by routers_make_ed_keys_unique, leading to an out-of-bounds write on directory authorities. This bug was originally introduced in26e89742, but it doesn't look possible to trigger until routers_make_ed_keys_unique was introduced in13a31e72. Fixes bug 19032; bugfix on tor 0.2.8.2-alpha.
This commit is contained in:
+1
-1
@@ -50,7 +50,7 @@ int list_server_status_v1(smartlist_t *routers, char **router_status_out,
|
||||
int dirserv_dump_directory_to_string(char **dir_out,
|
||||
crypto_pk_t *private_key);
|
||||
char *dirserv_get_flag_thresholds_line(void);
|
||||
void dirserv_compute_bridge_flag_thresholds(const smartlist_t *routers);
|
||||
void dirserv_compute_bridge_flag_thresholds(void);
|
||||
|
||||
int directory_fetches_from_authorities(const or_options_t *options);
|
||||
int directory_fetches_dir_info_early(const or_options_t *options);
|
||||
|
||||
Reference in New Issue
Block a user