Don't crash on malformed EXTENDCIRCUIT.

Fixes 14116; bugfix on ac68704f in 0.2.2.9-alpha.

diff --git a/changes/bug14116_025 b/changes/bug14116_025
new file mode 100644 (file)
index 0000000..0859f62
--- /dev/null
+++ b/changes/bug14116_025
@@ -0,0 +1,3 @@
+  o Minor bugfixes (controller):
+    - Avoid crashing on a malformed EXTENDCIRCUIT command. Fixes bug 14116;
+      bugfix on 0.2.2.9-alpha.

diff --git a/src/or/control.c b/src/or/control.c
index 9378f38f406206f1f689a0fa0fd8181942736f22..bdd91fc4be01b7f4751dcaa54a385fc4ecf66fd0 100644 (file)
--- a/src/or/control.c
+++ b/src/or/control.c
@@ -2451,6 +2451,14 @@ handle_control_extendcircuit(control_connection_t *conn, uint32_t len,
     goto done;
   }
 
+  if (smartlist_len(args) < 2) {
+    connection_printf_to_buf(conn,
+                             "512 syntax error: not enough arguments.\r\n");
+    SMARTLIST_FOREACH(args, char *, cp, tor_free(cp));
+    smartlist_free(args);
+    goto done;
+  }
+
   smartlist_split_string(router_nicknames, smartlist_get(args,1), ",", 0, 0);
 
   SMARTLIST_FOREACH(args, char *, cp, tor_free(cp));