commit 952c9073ad255442adcf4e85f7b2150c3bbe91de Author: teor teor2345@gmail.com Date: Fri Jun 16 09:41:29 2017 +1000
Check for trailing input garbage in tor_compress_impl() when decompressing
Fixes #22629. --- src/common/compress.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/common/compress.c b/src/common/compress.c index 92b64d1..ee9de6a 100644 --- a/src/common/compress.c +++ b/src/common/compress.c @@ -139,7 +139,15 @@ tor_compress_impl(int compress, if (compress || complete_only) { goto err; } else { - goto done; + if (in_len != 0) { + log_fn(protocol_warn_level, LD_PROTOCOL, + "Unexpected extra input while decompressing"); + log_debug(LD_GENERAL, "method: %d level: %d at len: %zd", + method, compression_level, in_len); + goto err; + } else { + goto done; + } } break; case TOR_COMPRESS_BUFFER_FULL: {