Check answer_len in the remap_addr case of process_relay_cell_not_open.

Fix an edge case where a malicious exit relay could convince a
controller that the client's DNS question resolves to an internal IP
address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta.

diff --git a/ChangeLog b/ChangeLog
index 527adc95430584eb6e5b1488cac3f01cd58b53d6..bce2aa39d94dc6471edc50c43287b2d8aee4093d 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,9 @@
 Changes in version 0.2.1.16-?? - 2009-??-??
+  o Security fixes:
+    - Fix an edge case where a malicious exit relay could convince a
+      controller that the client's DNS question resolves to an internal IP
+      address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta.
+
   o Major performance improvements (on 0.2.0.x):
     - Disable and refactor some debugging checks that forced a linear scan
       over the whole server-side DNS cache.  These accounted for over 50%

diff --git a/src/or/relay.c b/src/or/relay.c
index 85cd8f6c82392228cd3f48812a5a70569cb4539e..9657a82956e10b766f39188f3cf23ff2179984df 100644 (file)
--- a/src/or/relay.c
+++ b/src/or/relay.c
@@ -947,7 +947,7 @@ connection_edge_process_relay_cell_not_open(
                    cell->payload+RELAY_HEADER_SIZE+2, /*answer*/
                    ttl,
                    -1);
-    if (answer_type == RESOLVED_TYPE_IPV4) {
+    if (answer_type == RESOLVED_TYPE_IPV4 && answer_len >= 4) {
       uint32_t addr = ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+2));
       remap_event_helper(conn, addr);
     }