From: Nick Mathewson <nickm@torproject.org>
Date: Fri, 3 Aug 2012 14:53:00 +0000 (-0400)
Subject: Avoid possible segfault when handling networkstatus vote with bad flavor
X-Git-Tag: tor-0.2.3.20-rc~3^2~2^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=57e35ad3d91724882c345ac709666a551a977f0f;p=thirdparty%2Ftor.git

Avoid possible segfault when handling networkstatus vote with bad flavor

Fix for 6530; fix on 0.2.2.6-alpha.
---

diff --git a/changes/bug6530 b/changes/bug6530
new file mode 100644
index 0000000000..a6b7caa1a0
--- /dev/null
+++ b/changes/bug6530
@@ -0,0 +1,4 @@
+  o Major bugfixes:
+    - Avoid a read of uninitializd RAM when reading a vote or consensus
+      document with an unrecognized flavor name.  Fixes bug 6530; bugfix on
+      0.2.2.6-alpha.
diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index 8c4f582c07..2ff546bb1d 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -2821,7 +2821,7 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out,
     int flavor = networkstatus_parse_flavor_name(tok->args[1]);
     if (flavor < 0) {
       log_warn(LD_DIR, "Can't parse document with unknown flavor %s",
-               escaped(tok->args[2]));
+               escaped(tok->args[1]));
       goto err;
     }
     ns->flavor = flav = flavor;