[tor-commits] [tor/maint-0.2.4] Reject most directory documents with an internal NUL.

[nickm at torproject.org]

commit 0cf2c01dbd9b86d396a55186e0656db33c7929d8
Author: Nick Mathewson <nickm at torproject.org>
Date:   Fri Mar 15 13:49:04 2013 -0400

    Reject most directory documents with an internal NUL.
    
    (Specifically, we reject all the ones that aren't NUL-terminated,
    since a NUL-terminated thing can't have a NUL in the middle.)
    
    Another fix for #8037.
---
 changes/bug8037      |    4 ++++
 src/or/routerparse.c |    9 ++++++++-
 2 files changed, 12 insertions(+), 1 deletions(-)

diff --git a/changes/bug8037 b/changes/bug8037
index 5f3c1a3..989745f 100644
--- a/changes/bug8037
+++ b/changes/bug8037
@@ -2,3 +2,7 @@
     - Correctly store microdescriptors and extrainfo descriptors with
       an internal NUL byte. Fixes bug 8037; bugfix on 0.2.0.1-alpha.
       Bug reported by "cypherpunks".
+
+  o Minor features:
+    - Reject as invalid most directory objects containing a
+      NUL. Belt-and-suspender fix for bug 8037.
diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index 23dae38..2c345ae 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -3902,8 +3902,15 @@ tokenize_string(memarea_t *area,
   tor_assert(area);
 
   s = &start;
-  if (!end)
+  if (!end) {
     end = start+strlen(start);
+  } else {
+    /* it's only meaningful to check for nuls if we got an end-of-string ptr */
+    if (memchr(start, '\0', end-start)) {
+      log_warn(LD_DIR, "parse error: internal NUL character.");
+      return -1;
+    }
+  }
   for (i = 0; i < NIL_; ++i)
     counts[i] = 0;