[tor-bugs] #9925 [Tor]: Directory Authorities can crash client/relay

[Tor Bug Tracker & Wiki]

#9925: Directory Authorities can crash client/relay
------------------------+--------------------------------
     Reporter:  sysrqb  |      Owner:
         Type:  defect  |     Status:  needs_revision
     Priority:  normal  |  Milestone:  Tor: 0.2.5.x-final
    Component:  Tor     |    Version:
   Resolution:          |   Keywords:
Actual Points:          |  Parent ID:
       Points:          |
------------------------+--------------------------------
Changes (by nickm):

 * status:  new => needs_revision


Comment:

 Reviewing just the code: Well, you can't compare digest with strncmp.
 memcmp would be tradtional, but in this case tor_memeq and tor_memneq are
 what you should use.  Also, prefer uint8_t[] to char[] for bytes that
 aren't going to a human.  Also, it looks as though you neer actually set
 need_to_fetch to 0.

 Also, this can't be right:
 {{{
 +        if (!(ri = router_get_by_id_digest(rs->identity_digest))) {
 +          if (tor_memneq(ri->cache_info.signed_descriptor_digest,
 }}}
 The second "if" will only be executed if ri is NULL.  But if ri is NULL,
 it will crash.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9925#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online