sarah
/
tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge branch 'maint-0.3.0' into release-0.3.0

This commit is contained in:
Nick Mathewson 2017-06-08 09:21:15 -04:00
parent 916791f0be 53011e3e54
commit 63d0426af5
3 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/trove-2017-004
View File

@ -1,8 +1,8 @@
o Major bugfixes (hidden service, relay, security):
- Fix an assertion failure when an hidden service handles a
- Fix an assertion failure when a hidden service handles a
malformed BEGIN cell. This bug resulted in the service crashing
triggered by a tor_assert(). Fixes bug 22493, tracked as
TROVE-2017-004 and as CVE-2017-0375; bugfix on tor-0.3.0.1-alpha.
TROVE-2017-004 and as CVE-2017-0375; bugfix on 0.3.0.1-alpha.
Found by armadev.

7
changes/trove-2017-005 Normal file
View File

@ -0,0 +1,7 @@
o Major bugfixes (hidden service, relay, security):
- Fix an assertion failure caused by receiving a BEGIN_DIR cell on
a hidden service rendezvous circuit. Fixes bug 22494, tracked as
TROVE-2017-005 and CVE-2017-0376; bugfix on 0.2.2.1-alpha. Found
by armadev.

3
src/or/relay.c
View File

@ -1535,7 +1535,8 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ,
"Begin cell for known stream. Dropping.");
return 0;
}
if (rh.command == RELAY_COMMAND_BEGIN_DIR) {
if (rh.command == RELAY_COMMAND_BEGIN_DIR &&
circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) {
/* Assign this circuit and its app-ward OR connection a unique ID,
* so that we can measure download times. The local edge and dir
* connection will be assigned the same ID when they are created