[tor-bugs] #20715 [Core Tor/Tor]: memory leak in tor_cert_parse()

[Tor Bug Tracker & Wiki]

#20715: memory leak in tor_cert_parse()
--------------------------+------------------------------------
 Reporter:  arma          |          Owner:
     Type:  defect        |         Status:  new
 Priority:  Medium        |      Milestone:  Tor: 0.2.9.x-final
Component:  Core Tor/Tor  |        Version:  Tor: 0.2.9.5-alpha
 Severity:  Normal        |     Resolution:
 Keywords:                |  Actual Points:
Parent ID:                |         Points:
 Reviewer:                |        Sponsor:
--------------------------+------------------------------------

Comment (by arma):

 signed_descriptor_move() looks interesting here:
 {{{
   ri = router_parse_entry_from_string(body,
 body+sd->signed_descriptor_len+sd->annotations_len,
                          0, 1, NULL, NULL);
   if (!ri)
     return NULL;
   signed_descriptor_move(&ri->cache_info, sd);
 }}}

 So in the router_parse_entry(), we make a new cert and assign it to
 {{{
       router->cache_info.signing_key_cert = cert;
 }}}

 But then in signed_descriptor_move we
 {{{
   memcpy(dest, src, sizeof(signed_descriptor_t));
 }}}

 Does that clobber the old ri->cache_info.signing_key_cert with whatever
 was in sd?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20715#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online