Avoid possible segfault when handling networkstatus vote with bad flavor

Fix for 6530; fix on 0.2.2.6-alpha.

diff --git a/changes/bug6530 b/changes/bug6530
new file mode 100644 (file)
index 0000000..a6b7caa
--- /dev/null
+++ b/changes/bug6530
@@ -0,0 +1,4 @@
+  o Major bugfixes:
+    - Avoid a read of uninitializd RAM when reading a vote or consensus
+      document with an unrecognized flavor name.  Fixes bug 6530; bugfix on
+      0.2.2.6-alpha.

diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index 8c4f582c076d2c0aa88aae84c67e46311e411246..2ff546bb1d509210692ac2a3b071454790e5c66e 100644 (file)
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -2821,7 +2821,7 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out,
     int flavor = networkstatus_parse_flavor_name(tok->args[1]);
     if (flavor < 0) {
       log_warn(LD_DIR, "Can't parse document with unknown flavor %s",
-               escaped(tok->args[2]));
+               escaped(tok->args[1]));
       goto err;
     }
     ns->flavor = flav = flavor;