[tor-commits] [tor/release-0.3.4] hs: Silence a spurious warning in rend_client_send_introduction()

[nickm at torproject.org]

commit 9d5c6317b51530d606222cc2b7f6f5f5d7defe24
Author: teor <teor at torproject.org>
Date:   Wed Sep 5 21:07:58 2018 +1000

    hs: Silence a spurious warning in rend_client_send_introduction()
    
    gcc 8 warns that extend_info_t.nickname might be truncated by strncpy().
    
    But it doesn't know that nickname can either contain a hex id, or a
    nicknames. hex ids are only used for general and HSDir circuits.
    
    Fixes bug 27463; bugfix on 0.1.1.2-alpha.
---
 changes/bug27463    | 3 +++
 src/or/rendclient.c | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/changes/bug27463 b/changes/bug27463
new file mode 100644
index 000000000..073acdd99
--- /dev/null
+++ b/changes/bug27463
@@ -0,0 +1,3 @@
+  o Minor bugfixes (onion services):
+    - Silence a spurious compiler warning in rend_client_send_introduction().
+      Fixes bug 27463; bugfix on 0.1.1.2-alpha.
diff --git a/src/or/rendclient.c b/src/or/rendclient.c
index a93bc94a9..f0144b076 100644
--- a/src/or/rendclient.c
+++ b/src/or/rendclient.c
@@ -269,6 +269,15 @@ rend_client_send_introduction(origin_circuit_t *introcirc,
     dh_offset = v3_shift+7+DIGEST_LEN+2+klen+REND_COOKIE_LEN;
   } else {
     /* Version 0. */
+
+    /* Some compilers are smart enough to work out that nickname can be more
+     * than 19 characters, when it's a hexdigest. They warn that strncpy()
+     * will truncate hexdigests without NUL-terminating them. But we only put
+     * hexdigests in HSDir and general circuit exits. */
+    if (BUG(strlen(rendcirc->build_state->chosen_exit->nickname)
+            > MAX_NICKNAME_LEN)) {
+      goto perm_err;
+    }
     strncpy(tmp, rendcirc->build_state->chosen_exit->nickname,
             (MAX_NICKNAME_LEN+1)); /* nul pads */
     memcpy(tmp+MAX_NICKNAME_LEN+1, rendcirc->rend_data->rend_cookie,