Commit 03e3cf6a authored by Nick Mathewson's avatar Nick Mathewson 🦀
Browse files

Merge remote-tracking branch 'public/bug16400_026' into maint-0.2.6

parents f18ee7fc e0b75988

changes/bug16400

0 → 100644
+5 −0
Original line number Diff line number Diff line 
  o Major bugfixes:

   - Do not crash with an assertion error when parsing certain kinds

     of malformed or truncated microdescriptors. Fixes bug 16400;

     bugfix on 0.2.6.1-alpha. Found by "torkeln"; fix based on a patch by

     "cypherpunks_backup".

src/or/routerparse.c

+11 −3
Original line number Diff line number Diff line
@@ -4165,7 +4165,10 @@ microdescs_parse_from_string(const char *s, const char *eos, 
    {

      const char *cp = tor_memstr(s, start_of_next_microdesc-s,

                                  "onion-key");

      tor_assert(cp);

      const int no_onion_key = (cp == NULL);

      if (no_onion_key) {

        cp = s; /* So that we have *some* junk to put in the body */

      }



      md->bodylen = start_of_next_microdesc - cp;

      md->saved_location = where;
@@ -4174,8 +4177,13 @@ microdescs_parse_from_string(const char *s, const char *eos, 
      else

        md->body = (char*)cp;

      md->off = cp - start;

    }

      crypto_digest256(md->digest, md->body, md->bodylen, DIGEST_SHA256);

      if (no_onion_key) {

        log_fn(LOG_PROTOCOL_WARN, LD_DIR, "Malformed or truncated descriptor");

        goto next;

      }

    }





    if (tokenize_string(area, s, start_of_next_microdesc, tokens,

                        microdesc_token_table, flags)) {

src/test/test_microdesc.c

+34 −0
Original line number Diff line number Diff line
@@ -713,12 +713,46 @@ test_md_reject_cache(void *arg) 
  tor_free(mock_ns_val);

}



static void

test_md_corrupt_desc(void *arg)

{

  char *cp = NULL;

  smartlist_t *sl = NULL;

  (void) arg;



  sl = microdescs_add_to_cache(get_microdesc_cache(),

                               "@last-listed 2015-06-22 10:00:00\n"

                               "onion-k\n",

                               NULL, SAVED_IN_JOURNAL, 0, time(NULL), NULL);

  tt_int_op(smartlist_len(sl), ==, 0);

  smartlist_free(sl);



  sl = microdescs_add_to_cache(get_microdesc_cache(),

                               "@last-listed 2015-06-22 10:00:00\n"

                               "wiggly\n",

                               NULL, SAVED_IN_JOURNAL, 0, time(NULL), NULL);

  tt_int_op(smartlist_len(sl), ==, 0);

  smartlist_free(sl);



  tor_asprintf(&cp, "%s\n%s", test_md1, "@foobar\nonion-wobble\n");



  sl = microdescs_add_to_cache(get_microdesc_cache(),

                               cp, cp+strlen(cp),

                               SAVED_IN_JOURNAL, 0, time(NULL), NULL);

  tt_int_op(smartlist_len(sl), ==, 0);

  smartlist_free(sl);



 done:

  tor_free(cp);

}



struct testcase_t microdesc_tests[] = {

  { "cache", test_md_cache, TT_FORK, NULL, NULL },

  { "broken_cache", test_md_cache_broken, TT_FORK, NULL, NULL },

  { "generate", test_md_generate, 0, NULL, NULL },

  { "parse", test_md_parse, 0, NULL, NULL },

  { "reject_cache", test_md_reject_cache, TT_FORK, NULL, NULL },

  { "corrupt_desc", test_md_corrupt_desc, TT_FORK, NULL, NULL },

  END_OF_TESTCASES

};