commit 881c7c0f7d86af501f7eeb34b021636af85d186f Author: rl1987 <rl1987@sdf.lonestar.org> Date: Tue Dec 24 21:50:58 2013 +0200 10365: Close connections if the VERSIONS cell has an odd length. Fixes issue 10365. --- changes/bug10365 | 7 +++++++ src/or/channeltls.c | 8 ++++++++ 2 files changed, 15 insertions(+) diff --git a/changes/bug10365 b/changes/bug10365 new file mode 100644 index 0000000..f7a1515 --- /dev/null +++ b/changes/bug10365 @@ -0,0 +1,7 @@ + o Minor bugfixes: + + - When receving a VERSIONS cell with an odd number of bytes, close + the connection immediately. Fix for bug 10365; bugfix on + 0.2.0.10-alpha. Spotted by "bobnomnom"; fix by "rl1987". + + diff --git a/src/or/channeltls.c b/src/or/channeltls.c index 4943054..9a29077 100644 --- a/src/or/channeltls.c +++ b/src/or/channeltls.c @@ -1208,6 +1208,14 @@ channel_tls_process_versions_cell(var_cell_t *cell, channel_tls_t *chan) tor_assert(chan); tor_assert(chan->conn); + if ((cell->payload_len % 2) == 1) { + log_fn(LOG_PROTOCOL_WARN, LD_OR, + "Received a VERSION cell with odd payload length %d; " + "closing connection.",cell->payload_len); + connection_or_close_for_error(chan->conn, 0); + return; + } + started_here = connection_or_nonopen_was_started_here(chan->conn); if (chan->conn->link_proto != 0 ||