Stop modifying const argument in handle_control_postdescriptor

Fixes 15546.

diff --git a/changes/bug15546 b/changes/bug15546
new file mode 100644 (file)
index 0000000..b33b0aa
--- /dev/null
+++ b/changes/bug15546
@@ -0,0 +1,4 @@
+  o Minor bugfixes:
+   - For correctness, avoid modifying a constant string in
+     handle_control_postdescriptor. Fixes bug 15546; bugfix on
+     0.1.1.16-rc.
\ No newline at end of file

diff --git a/src/or/control.c b/src/or/control.c
index 5ec97bd9af0c024562586e8432d2b228e2b8b01e..9b0981d84a63cbb629670c4ecbe472082e5ed708 100644 (file)
--- a/src/or/control.c
+++ b/src/or/control.c
@@ -2733,12 +2733,14 @@ handle_control_postdescriptor(control_connection_t *conn, uint32_t len,
   uint8_t purpose = ROUTER_PURPOSE_GENERAL;
   int cache = 0; /* eventually, we may switch this to 1 */
 
-  char *cp = memchr(body, '\n', len);
+  const char *cp = memchr(body, '\n', len);
   smartlist_t *args = smartlist_new();
   tor_assert(cp);
-  *cp++ = '\0';
+  ++cp;
 
-  smartlist_split_string(args, body, " ",
+  char *cmdline = tor_memdup_nulterm(body, cp-body);
+
+  smartlist_split_string(args, cmdline, " ",
                          SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 0);
   SMARTLIST_FOREACH_BEGIN(args, char *, option) {
     if (!strcasecmpstart(option, "purpose=")) {
@@ -2787,6 +2789,7 @@ handle_control_postdescriptor(control_connection_t *conn, uint32_t len,
  done:
   SMARTLIST_FOREACH(args, char *, arg, tor_free(arg));
   smartlist_free(args);
+  tor_free(cmdline);
   return 0;
 }