torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/maint-0.2.2'

Browse Source
This commit is contained in:
Nick Mathewson
2011-12-15 11:32:49 -05:00
parent 960f62bd82 562c974ee7
commit e402edd960
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/buffer_bug
+7
View File
@@ -0,0 +1,7 @@
o Major bugfixes:
- Fix a heap overflow bug that could occur when trying to pull
data into the first chunk of a buffer, when that chunk had
already had some data drained from it. Fixes CVE-2011-2778;
bugfix on 0.2.0.16-alpha. Reported by "Vektor".
src/or/buffers.c
+3 -2
View File
@@ -401,9 +401,10 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate)
if (buf->head->memlen >= capacity) {
/* We don't need to grow the first chunk, but we might need to repack it.*/
if (CHUNK_REMAINING_CAPACITY(buf->head) < capacity-buf->datalen)
size_t needed = capacity - buf->head->datalen;
if (CHUNK_REMAINING_CAPACITY(buf->head) < needed)
chunk_repack(buf->head);
tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= capacity-buf->datalen);
tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= needed);
} else {
chunk_t *newhead;
size_t newsize;