From: Nick Mathewson <nickm@torproject.org>
Date: Tue, 7 Mar 2017 21:06:03 +0000 (-0500)
Subject: Prop140: Fix a crash bug.
X-Git-Tag: tor-0.3.1.1-alpha~213^2~9
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=12d428aaff6d90cadeaca12367f4e14fa673e51c;p=thirdparty%2Ftor.git

Prop140: Fix a crash bug.

Found while fuzzing: this could occur if we tried to copy a
nonexistent "line 0" while applying a diff.
---

diff --git a/src/or/consdiff.c b/src/or/consdiff.c
index 16933deb89..c33bad1940 100644
--- a/src/or/consdiff.c
+++ b/src/or/consdiff.c
@@ -742,7 +742,7 @@ apply_ed_diff(const smartlist_t *cons1, const smartlist_t *diff,
     }
 
     /* Add unchanged lines. */
-    for (; j > end; --j) {
+    for (; j && j > end; --j) {
       const char *cons_line = smartlist_get(cons1, j-1);
       smartlist_add(cons2, tor_strdup(cons_line));
     }