In get_token(), we could read one byte past the end of the
region. This is only a big problem in the case where the region
itself is (a) potentially hostile, and (b) not explicitly
nul-terminated.

This patch fixes the underlying bug, and also makes sure that the
one remaining case of not-NUL-terminated potentially hostile data
gets NUL-terminated.

Fix for bug 21018, TROVE-2016-12-002, and CVE-2016-1254

It had been a directory authority since 0.2.1.20.

Issues noted by cypherpunks on #18162

This closes bug 18162; bugfix on a45b1315, which fixed a related
issue long ago.

In addition to the #18162 issues, this fixes a signed integer overflow
in smarltist_add_all(), which is probably not so great either.

teor (Tim Wilson-Brown) authored 9 years ago and Nick Mathewson committed 9 years ago

This new identity key was changed on 18 November 2015.

There was a dead check when we made sure that an array member of a
struct was non-NULL.  Tor has been doing this check since at least
0.2.3, maybe earlier.

Fixes bug 17781.

Yawning Angel authored 10 years ago and Nick Mathewson committed 10 years ago

In theory these should never the triggered as the only caller now
validates the parameters before this routine gets called.

Yawning Angel authored 10 years ago and Nick Mathewson committed 10 years ago

Found by DonnchaC.