sarah
/
tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix a stack-protector warning: don't use a variable-length buffer 

Instead, define a maximum size, and enforce it with an assertion.
This commit is contained in:
Nick Mathewson 2018-02-15 20:52:01 -05:00
parent ed1d630f0e
commit 4d994e7a9c
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/or/onion.c
View File

@ -521,6 +521,11 @@ onion_skin_create(int type,
return r;
}
/* This is the maximum value for keys_out_len passed to
* onion_skin_server_handshake, plus 16. We can make it bigger if needed:
* It just defines how many bytes to stack-allocate. */
#define MAX_KEYS_TMP_LEN 128
/** Perform the second (server-side) step of a circuit-creation handshake of
* type <b>type</b>, responding to the client request in <b>onion_skin</b>
* using the keys in <b>keys</b>. On success, write our response into
@ -563,7 +568,8 @@ onion_skin_server_handshake(int type,
return -1;
{
size_t keys_tmp_len = keys_out_len + DIGEST_LEN;
uint8_t keys_tmp[keys_tmp_len];
tor_assert(keys_tmp_len <= MAX_KEYS_TMP_LEN);
uint8_t keys_tmp[MAX_KEYS_TMP_LEN];
if (onion_skin_ntor_server_handshake(
onion_skin, keys->curve25519_key_map,
@ -573,9 +579,10 @@ onion_skin_server_handshake(int type,
/* no need to memwipe here, since the output will never be used */
return -1;
}
memcpy(keys_out, keys_tmp, keys_out_len);
memcpy(rend_nonce_out, keys_tmp+keys_out_len, DIGEST_LEN);
memwipe(keys_tmp, 0, keys_tmp_len);
memwipe(keys_tmp, 0, sizeof(keys_tmp));
r = NTOR_REPLY_LEN;
}
break;