[tor-commits] [tor/release-0.2.6] Fix out-of-bounds read in INTRODUCE2 client auth

[nickm at torproject.org]

commit 2b27ce52d2b96a91410fbf8e9c6f2ce7cf036961
Author: John Brooks <john.brooks at dereferenced.net>
Date:   Sat Apr 25 22:52:35 2015 -0600

    Fix out-of-bounds read in INTRODUCE2 client auth
    
    The length of auth_data from an INTRODUCE2 cell is checked when the
    auth_type is recognized (1 or 2), but not for any other non-zero
    auth_type. Later, auth_data is assumed to have at least
    REND_DESC_COOKIE_LEN bytes, leading to a client-triggered out of bounds
    read.
    
    Fixed by checking auth_len before comparing the descriptor cookie
    against known clients.
    
    Fixes #15823; bugfix on 0.2.1.6-alpha.
---
 changes/bug15823     |    4 ++++
 src/or/rendservice.c |   18 ++++++++++++++----
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/changes/bug15823 b/changes/bug15823
new file mode 100644
index 0000000..987de5d
--- /dev/null
+++ b/changes/bug15823
@@ -0,0 +1,4 @@
+  o Minor bugfixes (hidden service):
+    - Fix an out-of-bounds read when parsing invalid INTRODUCE2 cells
+      on a client authorized hidden service. Fixes bug 15823; bugfix
+      on 0.2.1.6-alpha.
diff --git a/src/or/rendservice.c b/src/or/rendservice.c
index 4a8d6c5..d958de9 100644
--- a/src/or/rendservice.c
+++ b/src/or/rendservice.c
@@ -969,11 +969,13 @@ rend_service_requires_uptime(rend_service_t *service)
   return 0;
 }
 
-/** Check client authorization of a given <b>descriptor_cookie</b> for
- * <b>service</b>. Return 1 for success and 0 for failure. */
+/** Check client authorization of a given <b>descriptor_cookie</b> of
+ * length <b>cookie_len</b> for <b>service</b>. Return 1 for success
+ * and 0 for failure. */
 static int
 rend_check_authorization(rend_service_t *service,
-                         const char *descriptor_cookie)
+                         const char *descriptor_cookie,
+                         size_t cookie_len)
 {
   rend_authorized_client_t *auth_client = NULL;
   tor_assert(service);
@@ -984,6 +986,13 @@ rend_check_authorization(rend_service_t *service,
     return 0;
   }
 
+  if (cookie_len != REND_DESC_COOKIE_LEN) {
+    log_info(LD_REND, "Descriptor cookie is %lu bytes, but we expected "
+                      "%lu bytes. Dropping cell.",
+             (unsigned long)cookie_len, (unsigned long)REND_DESC_COOKIE_LEN);
+    return 0;
+  }
+
   /* Look up client authorization by descriptor cookie. */
   SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, client, {
     if (tor_memeq(client->descriptor_cookie, descriptor_cookie,
@@ -1330,7 +1339,8 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request,
   if (service->clients) {
     if (parsed_req->version == 3 && parsed_req->u.v3.auth_len > 0) {
       if (rend_check_authorization(service,
-                                   (const char*)parsed_req->u.v3.auth_data)) {
+                                   (const char*)parsed_req->u.v3.auth_data,
+                                   parsed_req->u.v3.auth_len)) {
         log_info(LD_REND, "Authorization data in INTRODUCE2 cell are valid.");
       } else {
         log_info(LD_REND, "The authorization data that are contained in "