From: Stephen Palmateer <stephen.palmateer@gmail.com>
Date: Wed, 21 Dec 2011 17:48:38 +0000 (-0500)
Subject: Remove (untriggerable) overflow in crypto_random_hostname()
X-Git-Tag: tor-0.2.3.11-alpha~42
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3fadc074caa2f69b9d4ef17339a42dc9fbe4ad9e;p=thirdparty%2Ftor.git

Remove (untriggerable) overflow in crypto_random_hostname()

Fixes bug 4413; bugfix on xxxx.

Hostname components cannot be larger than 63 characters.
This simple check makes certain randlen cannot overflow rand_bytes_len.
---

diff --git a/changes/bug4413 b/changes/bug4413
new file mode 100644
index 0000000000..653ddeb567
--- /dev/null
+++ b/changes/bug4413
@@ -0,0 +1,2 @@
+Minor bugfixes:
+    - Check for a potential, however unlikely, integer overflow. Fixes bug 4413; Bugfix on 0.2.3.9-alpha.
diff --git a/src/common/crypto.c b/src/common/crypto.c
index 673fc0cc1f..9ee3d989a3 100644
--- a/src/common/crypto.c
+++ b/src/common/crypto.c
@@ -82,6 +82,9 @@
 #include "sha256.c"
 #define SHA256_Final(a,b) sha256_done(b,a)
 
+/* Bug 4413*/
+#define MAX_HOSTNAME_SIZE 63
+
 static unsigned char *
 SHA256(const unsigned char *m, size_t len, unsigned char *d)
 {
@@ -2554,7 +2557,12 @@ crypto_random_hostname(int min_rand_len, int max_rand_len, const char *prefix,
   size_t resultlen, prefixlen;
 
   tor_assert(max_rand_len >= min_rand_len);
+
   randlen = min_rand_len + crypto_rand_int(max_rand_len - min_rand_len + 1);
+  if (randlen > MAX_HOSTNAME_SIZE) {
+    randlen = MAX_HOSTNAME_SIZE;
+  }
+
   prefixlen = strlen(prefix);
   resultlen = prefixlen + strlen(suffix) + randlen + 16;