From: teor <teor2345@gmail.com>
Date: Thu, 15 Jun 2017 23:41:29 +0000 (+1000)
Subject: Check for trailing input garbage in tor_compress_impl() when decompressing
X-Git-Tag: tor-0.3.1.4-alpha~41^2~4
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=952c9073ad255442adcf4e85f7b2150c3bbe91de;p=thirdparty%2Ftor.git

Check for trailing input garbage in tor_compress_impl() when decompressing

Fixes #22629.
---

diff --git a/src/common/compress.c b/src/common/compress.c
index 92b64d1e91..ee9de6a768 100644
--- a/src/common/compress.c
+++ b/src/common/compress.c
@@ -139,7 +139,15 @@ tor_compress_impl(int compress,
         if (compress || complete_only) {
           goto err;
         } else {
-          goto done;
+          if (in_len != 0) {
+            log_fn(protocol_warn_level, LD_PROTOCOL,
+                   "Unexpected extra input while decompressing");
+            log_debug(LD_GENERAL, "method: %d level: %d at len: %zd",
+                      method, compression_level, in_len);
+            goto err;
+          } else {
+            goto done;
+          }
         }
         break;
       case TOR_COMPRESS_BUFFER_FULL: {