torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix out-of-bounds write during voting with duplicate ed25519 keys

Browse Source 
In dirserv_compute_performance_thresholds, we allocate arrays based
on the length of 'routers', a list of routerinfo_t, but loop over
the nodelist. The 'routers' list may be shorter when relays were
filtered by routers_make_ed_keys_unique, leading to an out-of-bounds
write on directory authorities.

This bug was originally introduced in 26e89742, but it doesn't look
possible to trigger until routers_make_ed_keys_unique was introduced
in 13a31e72.

Fixes bug 19032; bugfix on tor 0.2.8.2-alpha.
This commit is contained in:
John Brooks
2016-05-11 12:13:22 -04:00
parent 61c0bae4f2
commit bf3e32a452
4 changed files with 22 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/or/networkstatus.c
+1 -2
View File
@@ -1697,11 +1697,10 @@ networkstatus_dump_bridge_status_to_file(time_t now)
char *fname = NULL;
char *thresholds = NULL;
char *published_thresholds_and_status = NULL;
routerlist_t *rl = router_get_routerlist();
char published[ISO_TIME_LEN+1];
format_iso_time(published, now);
dirserv_compute_bridge_flag_thresholds(rl->routers);
dirserv_compute_bridge_flag_thresholds();
thresholds = dirserv_get_flag_thresholds_line();
tor_asprintf(&published_thresholds_and_status,
"published %s\nflag-thresholds %s\n%s",