Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Maintenance:6096
tor.openSUSE_Leap_42.1_Update
CVE-2016-1254.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2016-1254.patch of Package tor.openSUSE_Leap_42.1_Update
From d978216dea6b21ac38230a59d172139185a68dbd Mon Sep 17 00:00:00 2001 From: Nick Mathewson <nickm@torproject.org> Date: Sun, 18 Dec 2016 20:13:58 -0500 Subject: Fix parsing bug with unecognized token at EOS In get_token(), we could read one byte past the end of the region. This is only a big problem in the case where the region itself is (a) potentially hostile, and (b) not explicitly nul-terminated. This patch fixes the underlying bug, and also makes sure that the one remaining case of not-NUL-terminated potentially hostile data gets NUL-terminated. Fix for bug 21018, TROVE-2016-12-002, and CVE-2016-1254 diff --git a/changes/bug21018 b/changes/bug21018 new file mode 100644 index 0000000..49a8b47 --- /dev/null +++ b/changes/bug21018 @@ -0,0 +1,11 @@ + o Major bugfixes (parsing, security): + + - Fix a bug in parsing that could cause clients to read a single + byte past the end of an allocated region. This bug could be + used to cause hardened clients (built with + --enable-expensive-hardening) to crash if they tried to visit + a hostile hidden service. Non-hardened clients are only + affected depending on the details of their platform's memory + allocator. Fixes bug 21018; bugfix on 0.2.0.8-alpha. Found by + using libFuzzer. Also tracked as TROVE-2016-12-002 and as + CVE-2016-1254. diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 176c16f..71373ce 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3857,7 +3857,7 @@ get_next_token(memarea_t *area, if (tok->tp == ERR_) { /* No keyword matched; call it an "K_opt" or "A_unrecognized" */ - if (**s == '@') + if (*s < eol && **s == '@') tok->tp = A_UNKNOWN_; else tok->tp = K_OPT; @@ -4863,7 +4863,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, crypto_cipher_free(cipher); len = ipos_encrypted_size - 2 - client_entries_len - CIPHER_IV_LEN; - dec = tor_malloc(len); + dec = tor_malloc_zero(len + 1); declen = crypto_cipher_decrypt_with_iv(session_key, dec, len, ipos_encrypted + 2 + client_entries_len, ipos_encrypted_size - 2 - client_entries_len); @@ -4895,7 +4895,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, "small."); return -1; } - dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1); + dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1 + 1); declen = crypto_cipher_decrypt_with_iv(descriptor_cookie, dec, ipos_encrypted_size - -- cgit v0.10.2
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor