Commit 0878bb96 authored by Nick Mathewson's avatar Nick Mathewson
Browse files

Fix two other cases of (buf + N > end) pattern

Related to fix for 28202.
parent 368413a3
...@@ -5299,13 +5299,13 @@ find_start_of_next_microdesc(const char *s, const char *eos) ...@@ -5299,13 +5299,13 @@ find_start_of_next_microdesc(const char *s, const char *eos)
return NULL; return NULL;
#define CHECK_LENGTH() STMT_BEGIN \ #define CHECK_LENGTH() STMT_BEGIN \
if (s+32 > eos) \ if (eos - s < 32) \
return NULL; \ return NULL; \
STMT_END STMT_END
#define NEXT_LINE() STMT_BEGIN \ #define NEXT_LINE() STMT_BEGIN \
s = memchr(s, '\n', eos-s); \ s = memchr(s, '\n', eos-s); \
if (!s || s+1 >= eos) \ if (!s || eos - s <= 1) \
return NULL; \ return NULL; \
s++; \ s++; \
STMT_END STMT_END
...@@ -5329,7 +5329,7 @@ find_start_of_next_microdesc(const char *s, const char *eos) ...@@ -5329,7 +5329,7 @@ find_start_of_next_microdesc(const char *s, const char *eos)
/* Okay, now we're pointed at the first line of the microdescriptor which is /* Okay, now we're pointed at the first line of the microdescriptor which is
not an annotation or onion-key. The next line that _is_ an annotation or not an annotation or onion-key. The next line that _is_ an annotation or
onion-key is the start of the next microdescriptor. */ onion-key is the start of the next microdescriptor. */
while (s+32 < eos) { while (eos - s > 32) {
if (*s == '@' || !strcmpstart(s, "onion-key")) if (*s == '@' || !strcmpstart(s, "onion-key"))
return s; return s;
NEXT_LINE(); NEXT_LINE();
...@@ -6359,4 +6359,3 @@ routerparse_free_all(void) ...@@ -6359,4 +6359,3 @@ routerparse_free_all(void)
{ {
dump_desc_fifo_cleanup(); dump_desc_fifo_cleanup();
} }
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment