mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-12-06 19:41:15 +01:00
bf3e32a452
In dirserv_compute_performance_thresholds, we allocate arrays based on the length of 'routers', a list of routerinfo_t, but loop over the nodelist. The 'routers' list may be shorter when relays were filtered by routers_make_ed_keys_unique, leading to an out-of-bounds write on directory authorities. This bug was originally introduced in26e89742, but it doesn't look possible to trigger until routers_make_ed_keys_unique was introduced in13a31e72. Fixes bug 19032; bugfix on tor 0.2.8.2-alpha.