src\or\rendclient.c:lookup_last_hid_serv_request: heap buffer overrun
src\or\rendclient.c:lookup_last_hid_serv_request:
lookup_last_hid_serv_request(routerstatus_t *hs_dir, const char *desc_id_base32, time_t now, int set)
[ Allocate enough memory to hold a pointer to a time_t (4 bytes on a 32-bit box). ]
last_request_ptr = tor_malloc_zero(sizeof(time_t *));
[ Write a time_t (8 bytes) into that location; heap buffer overrun: ]
*last_request_ptr = now;
[ This might "work" if your allocator defaults to 8-byte or greater alignment of request; but such behavior is not reliable. ]
[Automatically added by flyspray2trac: Operating System: Windows 2k/XP]
Trac:
Username: aakova