Skip to content
GitLab
Menu
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
David Goulet
Tor
Commits
42e4e156
Commit
42e4e156
authored
Jun 01, 2011
by
Nick Mathewson
🎨
Browse files
Detect insanely large circuit build state; don't give its length to rand_int
parent
5afab5ca
Changes
2
Hide whitespace changes
Inline
Side-by-side
changes/bug3306
View file @
42e4e156
...
...
@@ -3,3 +3,7 @@
correctly. Previously, it accepted values up to UINT_MAX, but
could return a negative number if given a value above INT_MAX+1.
Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14.
- Avoid a segfault when reading a malformed circuit build state
with more than INT_MAX entries. Found by wanoskarnet. Bugfix on
0.2.2.4-alpha.
src/or/circuitbuild.c
View file @
42e4e156
...
...
@@ -678,7 +678,15 @@ circuit_build_times_shuffle_and_store_array(circuit_build_times_t *cbt,
log_notice
(
LD_CIRC
,
"The number of circuit times that this Tor version "
"uses to calculate build times is less than the number stored "
"in your state file. Decreasing the circuit time history from "
"%d to %d."
,
num_times
,
CBT_NCIRCUITS_TO_OBSERVE
);
"%lu to %d."
,
(
unsigned
long
)
num_times
,
CBT_NCIRCUITS_TO_OBSERVE
);
}
if
(
n
>
INT_MAX
-
1
)
{
log_warn
(
LD_CIRC
,
"For some insane reasons, you had %lu circuit build "
"observations in your state file. That's far too many; probably "
"there's a bug here."
,
(
unsigned
long
)
n
);
n
=
INT_MAX
-
1
;
}
/* This code can only be run on a compact array */
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment