[tor-commits] [tor/release-0.3.0] Fix log-uninitialized-stack bug in rend_service_intro_established.

[nickm at torproject.org]

commit 4a2cbea6ce585fcdaf86a80ccf39bceb4137e86a
Author: Nick Mathewson <nickm at torproject.org>
Date:   Mon Sep 18 09:25:21 2017 -0400

    Fix log-uninitialized-stack bug in rend_service_intro_established.
    
    Fixes bug 23490; bugfix on 0.2.7.2-alpha.
    
    TROVE-2017-008
    CVE-2017-0380
---
 changes/trove-2017-008 | 5 +++++
 src/or/rendservice.c   | 4 ++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/changes/trove-2017-008 b/changes/trove-2017-008
new file mode 100644
index 000000000..4b9c5b0a1
--- /dev/null
+++ b/changes/trove-2017-008
@@ -0,0 +1,5 @@
+  o Major bugfixes (security, hidden services, loggging):
+    - Fix a bug where we could log uninitialized stack when a certain
+      hidden service error occurred while SafeLogging was disabled.
+      Fixes bug #23490; bugfix on 0.2.7.2-alpha.
+      This is also tracked as TROVE-2017-008 and CVE-2017-0380.
diff --git a/src/or/rendservice.c b/src/or/rendservice.c
index b81a01c56..0a5b5efd5 100644
--- a/src/or/rendservice.c
+++ b/src/or/rendservice.c
@@ -2859,6 +2859,8 @@ rend_service_intro_established(origin_circuit_t *circuit,
              (unsigned)circuit->base_.n_circ_id);
     goto err;
   }
+  base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1,
+                circuit->rend_data->rend_pk_digest, REND_SERVICE_ID_LEN);
   /* We've just successfully established a intro circuit to one of our
    * introduction point, account for it. */
   intro = find_intro_point(circuit);
@@ -2875,8 +2877,6 @@ rend_service_intro_established(origin_circuit_t *circuit,
   service->desc_is_dirty = time(NULL);
   circuit_change_purpose(TO_CIRCUIT(circuit), CIRCUIT_PURPOSE_S_INTRO);
 
-  base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1,
-                circuit->rend_data->rend_pk_digest, REND_SERVICE_ID_LEN);
   log_info(LD_REND,
            "Received INTRO_ESTABLISHED cell on circuit %u for service %s",
            (unsigned)circuit->base_.n_circ_id, serviceid);