[tor-commits] [tor/master] Add explicit check for 0-length extend2 cells

[nickm at torproject.org]

commit 90303602773eca8505229c832119dafcbcfe1ab7
Author: Nick Mathewson <nickm at torproject.org>
Date:   Fri Jan 3 10:43:09 2014 -0500

    Add explicit check for 0-length extend2 cells
    
    This is harmless in the Tor of today, but important for correctness.
    
    Fixes bug 10536; bugfix on 0.2.4.8-alpha. Reported by "cypherpunks".
---
 changes/bug10536 |    6 ++++++
 src/or/onion.c   |    7 +++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/changes/bug10536 b/changes/bug10536
new file mode 100644
index 0000000..e15da7c
--- /dev/null
+++ b/changes/bug10536
@@ -0,0 +1,6 @@
+
+  o Minor bugfixes:
+    - Reject 0-lenth EXTEND2 cells more expicitly. Previously our code would
+      reject them a bit later than it should have. This bug is
+      harmless. Fixes bug 10536; bugfix on 0.2.4.8-alpha. Reported by
+      "cypherpunks".
diff --git a/src/or/onion.c b/src/or/onion.c
index 3e1d63d..30b983d 100644
--- a/src/or/onion.c
+++ b/src/or/onion.c
@@ -860,14 +860,17 @@ extend_cell_parse(extend_cell_t *cell_out, const uint8_t command,
     }
   case RELAY_COMMAND_EXTEND2:
     {
-      uint8_t n_specs = *payload, spectype, speclen;
+      uint8_t n_specs, spectype, speclen;
       int i;
       int found_ipv4 = 0, found_ipv6 = 0, found_id = 0;
       tor_addr_make_unspec(&cell_out->orport_ipv4.addr);
       tor_addr_make_unspec(&cell_out->orport_ipv6.addr);
 
+      if (payload_length == 0)
+        return -1;
+
       cell_out->cell_type = RELAY_COMMAND_EXTEND2;
-      ++payload;
+      n_specs = *payload++;
       /* Parse the specifiers. We'll only take the first IPv4 and first IPv6
        * address, and the node ID, and ignore everything else */
       for (i = 0; i < n_specs; ++i) {