sarah
/
tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge branch 'maint-0.2.2' into release-0.2.2

This commit is contained in:
Nick Mathewson 2011-12-15 11:38:40 -05:00
parent ed46539050 562c974ee7
commit 2c70ca0e94
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
changes/buffer_bug Normal file
View File

@ -0,0 +1,7 @@
o Major bugfixes:
- Fix a heap overflow bug that could occur when trying to pull
data into the first chunk of a buffer, when that chunk had
already had some data drained from it. Fixes CVE-2011-2778;
bugfix on 0.2.0.16-alpha. Reported by "Vektor".

5
src/or/buffers.c
View File

@ -397,9 +397,10 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate)
if (buf->head->memlen >= capacity) {
/* We don't need to grow the first chunk, but we might need to repack it.*/
if (CHUNK_REMAINING_CAPACITY(buf->head) < capacity-buf->datalen)
size_t needed = capacity - buf->head->datalen;
if (CHUNK_REMAINING_CAPACITY(buf->head) < needed)
chunk_repack(buf->head);
tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= capacity-buf->datalen);
tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= needed);
} else {
chunk_t *newhead;
size_t newsize;