[tor-bugs] #11649 [Tor]: Memory leak when parsing broken microdescriptors

Tue Apr 29 16:57:17 UTC 2014

#11649: Memory leak when parsing broken microdescriptors
-------------------------------------------------+-------------------------
 Reporter:  nickm                                |          Owner:
     Type:  defect                               |         Status:  new
 Priority:  major                                |      Milestone:  Tor:
Component:  Tor                                  |  0.2.5.x-final
 Keywords:  tor-client 024-backport              |        Version:
  023-backport memory-leak valgrind              |  Actual Points:
Parent ID:                                       |         Points:
-------------------------------------------------+-------------------------
 When we're parsing microdescriptors, we don't clear the dynamically
 allocated part of the tokens after parsing.  This can leak memory if the
 microdescriptors are badly formed.

 This can enable a comparatively slow denial of service (on the order of
 several MB per MD download request made to a hostile source), and needs to
 be patched.

 Found as a needle in the haystack of #11618.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/11649>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online