commit fb7db9ecd0be04385ad5ae40e6e802cd80bb3455 Author: anonhelper torcontrib@airmail.cc Date: Wed Oct 21 02:07:26 2020 +0000

Fixed out-of-bounds write in onion pool. --- src/common/onion.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/common/onion.c b/src/common/onion.c index 6a61d83..d99bf5c 100644 --- a/src/common/onion.c +++ b/src/common/onion.c @@ -62,7 +62,7 @@ static int insert_onion_entry(struct onion_entry *entry, assert(entry); assert(pool);

- if (pool->count > pool->size) { + if (pool->count >= pool->size) { /* Double the size of the pool. */ ret = resize_onion_pool(pool, pool->size * 2); if (ret < 0) {