sarah
/
tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
tor/changes/bug15823

5 lines
200 B
Plaintext
Raw Normal View History

Fix out-of-bounds read in INTRODUCE2 client auth The length of auth_data from an INTRODUCE2 cell is checked when the auth_type is recognized (1 or 2), but not for any other non-zero auth_type. Later, auth_data is assumed to have at least REND_DESC_COOKIE_LEN bytes, leading to a client-triggered out of bounds read. Fixed by checking auth_len before comparing the descriptor cookie against known clients. Fixes #15823; bugfix on 0.2.1.6-alpha.
2015-04-26 04:52:35 +00:00
o Minor bugfixes (hidden service):
- Fix an out-of-bounds read when parsing invalid INTRODUCE2 cells
on a client authorized hidden service. Fixes bug 15823; bugfix
on 0.2.1.6-alpha.