From: Nick Mathewson <nickm@torproject.org>
Date: Wed, 14 Dec 2011 21:38:43 +0000 (-0500)
Subject: Add a fix for the buf_pullup bug that Vektor reported
X-Git-Tag: tor-0.2.1.32~4^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9d0777839be6642954a4c064c819d406d8bb7cb4;p=thirdparty%2Ftor.git

Add a fix for the buf_pullup bug that Vektor reported
---

diff --git a/changes/buffer_bug b/changes/buffer_bug
new file mode 100644
index 0000000000..634f609533
--- /dev/null
+++ b/changes/buffer_bug
@@ -0,0 +1,7 @@
+
+  o Major bugfixes:
+    - Fix a heap overflow bug that could occur when trying to pull
+      data into the first chunk of a buffer, when that chunk had
+      already had some data drained from it. Fixes CVE-2011-2778;
+      bugfix on 0.2.0.16-alpha. Reported by "Vektor".
+
diff --git a/src/or/buffers.c b/src/or/buffers.c
index 710374638b..5701604909 100644
--- a/src/or/buffers.c
+++ b/src/or/buffers.c
@@ -375,9 +375,10 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate)
 
   if (buf->head->memlen >= capacity) {
     /* We don't need to grow the first chunk, but we might need to repack it.*/
-    if (CHUNK_REMAINING_CAPACITY(buf->head) < capacity-buf->datalen)
+    size_t needed = capacity - buf->head->datalen;
+    if (CHUNK_REMAINING_CAPACITY(buf->head) < needed)
       chunk_repack(buf->head);
-    tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= capacity-buf->datalen);
+    tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= needed);
   } else {
     chunk_t *newhead;
     size_t newsize;