[tor-bugs] #9925 [Tor]: Directory Authorities can crash client/relay
Tor Bug Tracker & Wiki
blackhole at torproject.org
Tue Oct 8 16:34:55 UTC 2013
#9925: Directory Authorities can crash client/relay
------------------------+--------------------------------
Reporter: sysrqb | Owner:
Type: defect | Status: needs_revision
Priority: normal | Milestone: Tor: 0.2.5.x-final
Component: Tor | Version:
Resolution: | Keywords:
Actual Points: | Parent ID:
Points: |
------------------------+--------------------------------
Changes (by nickm):
* status: new => needs_revision
Comment:
Reviewing just the code: Well, you can't compare digest with strncmp.
memcmp would be tradtional, but in this case tor_memeq and tor_memneq are
what you should use. Also, prefer uint8_t[] to char[] for bytes that
aren't going to a human. Also, it looks as though you neer actually set
need_to_fetch to 0.
Also, this can't be right:
{{{
+ if (!(ri = router_get_by_id_digest(rs->identity_digest))) {
+ if (tor_memneq(ri->cache_info.signed_descriptor_digest,
}}}
The second "if" will only be executed if ri is NULL. But if ri is NULL,
it will crash.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9925#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
More information about the tor-bugs
mailing list