]> git.ipfire.org Git - thirdparty/tor.git/commit
Fix out-of-bounds write during voting with duplicate ed25519 keys
authorJohn Brooks <special@torproject.org>
Wed, 11 May 2016 16:13:22 +0000 (12:13 -0400)
committerJohn Brooks <special@torproject.org>
Wed, 11 May 2016 17:11:03 +0000 (13:11 -0400)
commitbf3e32a45288b64e5535e02f40bd2bcb93c8a520
treed3ae8afc737e828e69cbf6a583cadb0908a849f0
parent61c0bae4f20556cf155562582ea00a6a147252d6
Fix out-of-bounds write during voting with duplicate ed25519 keys

In dirserv_compute_performance_thresholds, we allocate arrays based
on the length of 'routers', a list of routerinfo_t, but loop over
the nodelist. The 'routers' list may be shorter when relays were
filtered by routers_make_ed_keys_unique, leading to an out-of-bounds
write on directory authorities.

This bug was originally introduced in 26e89742, but it doesn't look
possible to trigger until routers_make_ed_keys_unique was introduced
in 13a31e72.

Fixes bug 19032; bugfix on tor 0.2.8.2-alpha.
changes/bug19032 [new file with mode: 0644]
src/or/dirserv.c
src/or/dirserv.h
src/or/networkstatus.c