September 2017 - tor-commits - lists.torproject.org

[tor/release-0.3.1] Merge branch 'maint-0.3.1' into release-0.3.1
by nickm＠torproject.org 08 Sep '17

08 Sep '17

commit 6108499c99aa3cfa5ed7909720630857768c43b1 Merge: 636b5d19a 7a83cf75d Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 8 08:24:47 2017 -0400 Merge branch 'maint-0.3.1' into release-0.3.1 changes/bug22644 | 5 +++++ src/or/control.c | 16 ++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-)

1 0

[tor/release-0.3.0] Merge branch 'bug22644_029' into maint-0.2.9
by nickm＠torproject.org 08 Sep '17

08 Sep '17

commit 3cace828a9b42c62a73d1e3b79161a7f68aca40e Merge: 08592c95f 12dad5ebf Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 8 08:24:36 2017 -0400 Merge branch 'bug22644_029' into maint-0.2.9 changes/bug22644 | 5 +++++ src/or/control.c | 16 ++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-)

1 0

[tor/release-0.3.1] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 08 Sep '17

08 Sep '17

commit f5092e711fb08dfdf7a356f8c58f10effe6fb831 Merge: a9d4df9a0 3cace828a Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 8 08:24:47 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/bug22644 | 5 +++++ src/or/control.c | 16 ++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-)

1 0

[tor/release-0.3.1] Merge branch 'maint-0.3.0' into maint-0.3.1
by nickm＠torproject.org 08 Sep '17

08 Sep '17

commit 7a83cf75dc55dbac91ff5c0daf7c7418493cbea7 Merge: 54fb1d0f7 f5092e711 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 8 08:24:47 2017 -0400 Merge branch 'maint-0.3.0' into maint-0.3.1 changes/bug22644 | 5 +++++ src/or/control.c | 16 ++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-)

1 0

[tor/release-0.2.9] Merge branch 'bug22644_029' into maint-0.2.9
by nickm＠torproject.org 08 Sep '17

08 Sep '17

commit 3cace828a9b42c62a73d1e3b79161a7f68aca40e Merge: 08592c95f 12dad5ebf Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 8 08:24:36 2017 -0400 Merge branch 'bug22644_029' into maint-0.2.9 changes/bug22644 | 5 +++++ src/or/control.c | 16 ++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-)

1 0

[tor/release-0.3.1] Fix crashes on empty +HSPOST and +POSTDESCRIPTOR commands
by nickm＠torproject.org 08 Sep '17

08 Sep '17

commit 12dad5ebf798232111919d5498f522d5b3f146a5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Sep 7 09:20:00 2017 -0400 Fix crashes on empty +HSPOST and +POSTDESCRIPTOR commands Fixes bug 22644; bugfix on 0.2.7.1-alpha and 0.2.0.1-alpha respectively. --- changes/bug22644 | 5 +++++ src/or/control.c | 16 ++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/changes/bug22644 b/changes/bug22644 new file mode 100644 index 000000000..9b8742eda --- /dev/null +++ b/changes/bug22644 @@ -0,0 +1,5 @@ + o Minor bugfixes (controller): + - Do not crash when receiving a POSTDESCRIPTOR command with an + empty body. Fixes part of bug 22644; bugfix on 0.2.0.1-alpha. + - Do not crash when receiving a HSPOST command with an empty body. + Fixes part of bug 22644; bugfix on 0.2.7.1-alpha. diff --git a/src/or/control.c b/src/or/control.c index 1bf1e33bb..03d9fcee2 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -3568,12 +3568,15 @@ handle_control_postdescriptor(control_connection_t *conn, uint32_t len, int cache = 0; /* eventually, we may switch this to 1 */ const char *cp = memchr(body, '\n', len); - smartlist_t *args = smartlist_new(); - tor_assert(cp); + + if (cp == NULL) { + connection_printf_to_buf(conn, "251 Empty body\r\n"); + return 0; + } ++cp; char *cmdline = tor_memdup_nulterm(body, cp-body); - + smartlist_t *args = smartlist_new(); smartlist_split_string(args, cmdline, " ", SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 0); SMARTLIST_FOREACH_BEGIN(args, char *, option) { @@ -4158,14 +4161,19 @@ handle_control_hspost(control_connection_t *conn, const char *body) { static const char *opt_server = "SERVER="; - smartlist_t *args = smartlist_new(); smartlist_t *hs_dirs = NULL; const char *encoded_desc = body; size_t encoded_desc_len = len; char *cp = memchr(body, '\n', len); + if (cp == NULL) { + connection_printf_to_buf(conn, "251 Empty body\r\n"); + return 0; + } char *argline = tor_strndup(body, cp-body); + smartlist_t *args = smartlist_new(); + /* If any SERVER= options were specified, try parse the options line */ if (!strcasecmpstart(argline, opt_server)) { /* encoded_desc begins after a newline character */

1 0

[tor/release-0.3.0] Fix crashes on empty +HSPOST and +POSTDESCRIPTOR commands
by nickm＠torproject.org 08 Sep '17

08 Sep '17

commit 12dad5ebf798232111919d5498f522d5b3f146a5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Sep 7 09:20:00 2017 -0400 Fix crashes on empty +HSPOST and +POSTDESCRIPTOR commands Fixes bug 22644; bugfix on 0.2.7.1-alpha and 0.2.0.1-alpha respectively. --- changes/bug22644 | 5 +++++ src/or/control.c | 16 ++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/changes/bug22644 b/changes/bug22644 new file mode 100644 index 000000000..9b8742eda --- /dev/null +++ b/changes/bug22644 @@ -0,0 +1,5 @@ + o Minor bugfixes (controller): + - Do not crash when receiving a POSTDESCRIPTOR command with an + empty body. Fixes part of bug 22644; bugfix on 0.2.0.1-alpha. + - Do not crash when receiving a HSPOST command with an empty body. + Fixes part of bug 22644; bugfix on 0.2.7.1-alpha. diff --git a/src/or/control.c b/src/or/control.c index 1bf1e33bb..03d9fcee2 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -3568,12 +3568,15 @@ handle_control_postdescriptor(control_connection_t *conn, uint32_t len, int cache = 0; /* eventually, we may switch this to 1 */ const char *cp = memchr(body, '\n', len); - smartlist_t *args = smartlist_new(); - tor_assert(cp); + + if (cp == NULL) { + connection_printf_to_buf(conn, "251 Empty body\r\n"); + return 0; + } ++cp; char *cmdline = tor_memdup_nulterm(body, cp-body); - + smartlist_t *args = smartlist_new(); smartlist_split_string(args, cmdline, " ", SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 0); SMARTLIST_FOREACH_BEGIN(args, char *, option) { @@ -4158,14 +4161,19 @@ handle_control_hspost(control_connection_t *conn, const char *body) { static const char *opt_server = "SERVER="; - smartlist_t *args = smartlist_new(); smartlist_t *hs_dirs = NULL; const char *encoded_desc = body; size_t encoded_desc_len = len; char *cp = memchr(body, '\n', len); + if (cp == NULL) { + connection_printf_to_buf(conn, "251 Empty body\r\n"); + return 0; + } char *argline = tor_strndup(body, cp-body); + smartlist_t *args = smartlist_new(); + /* If any SERVER= options were specified, try parse the options line */ if (!strcasecmpstart(argline, opt_server)) { /* encoded_desc begins after a newline character */

1 0

[tor/release-0.3.1] Merge branch 'bug22644_029' into maint-0.2.9
by nickm＠torproject.org 08 Sep '17

08 Sep '17

commit 3cace828a9b42c62a73d1e3b79161a7f68aca40e Merge: 08592c95f 12dad5ebf Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 8 08:24:36 2017 -0400 Merge branch 'bug22644_029' into maint-0.2.9 changes/bug22644 | 5 +++++ src/or/control.c | 16 ++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 08 Sep '17

08 Sep '17

commit f5092e711fb08dfdf7a356f8c58f10effe6fb831 Merge: a9d4df9a0 3cace828a Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 8 08:24:47 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/bug22644 | 5 +++++ src/or/control.c | 16 ++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-)

1 0

[tor/release-0.3.0] Merge branch 'maint-0.3.0' into release-0.3.0
by nickm＠torproject.org 08 Sep '17

08 Sep '17

commit 3a7e2ce1b68fcd69fd2eb4d5cde1f153885f799f Merge: 4c21daa9e f5092e711 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 8 08:24:47 2017 -0400 Merge branch 'maint-0.3.0' into release-0.3.0 changes/bug22644 | 5 +++++ src/or/control.c | 16 ++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-)

1 0