Commit e24195c7 authored by cypherpunks's avatar cypherpunks
Browse files

protover: reject invalid protocol names

The spec only allows the characters [A-Za-z0-9-].

Fix on b2b2e1c7.
Fixes #27316; bugfix on 0.2.9.4-alpha.
parent c02f2d9e
o Minor bugfixes (protover):
- Reject protocol names containing bytes other than alphanumeric characters
and hyphens ([A-Za-z0-9-]). Fixes bug 27316; bugfix on 0.2.9.4-alpha.
...@@ -23,6 +23,7 @@ ...@@ -23,6 +23,7 @@
#define PROTOVER_PRIVATE #define PROTOVER_PRIVATE
#include "compat.h"
#include "or.h" #include "or.h"
#include "protover.h" #include "protover.h"
#include "routerparse.h" #include "routerparse.h"
...@@ -170,6 +171,16 @@ parse_version_range(const char *s, const char *end_of_range, ...@@ -170,6 +171,16 @@ parse_version_range(const char *s, const char *end_of_range,
return -1; return -1;
} }
static int
is_valid_keyword(const char *s, size_t n)
{
for (size_t i = 0; i < n; i++) {
if (!TOR_ISALNUM(s[i]) && s[i] != '-')
return 0;
}
return 1;
}
/** Parse a single protocol entry from <b>s</b> up to an optional /** Parse a single protocol entry from <b>s</b> up to an optional
* <b>end_of_entry</b> pointer, and return that protocol entry. Return NULL * <b>end_of_entry</b> pointer, and return that protocol entry. Return NULL
* on error. * on error.
...@@ -195,6 +206,10 @@ parse_single_entry(const char *s, const char *end_of_entry) ...@@ -195,6 +206,10 @@ parse_single_entry(const char *s, const char *end_of_entry)
if (equals == s) if (equals == s)
goto error; goto error;
/* The name must contain only alphanumeric characters and hyphens. */
if (!is_valid_keyword(s, equals-s))
goto error;
out->name = tor_strndup(s, equals-s); out->name = tor_strndup(s, equals-s);
tor_assert(equals < end_of_entry); tor_assert(equals < end_of_entry);
......
...@@ -283,6 +283,10 @@ test_protover_vote_roundtrip(void *args) ...@@ -283,6 +283,10 @@ test_protover_vote_roundtrip(void *args)
const char *input; const char *input;
const char *expected_output; const char *expected_output;
} examples[] = { } examples[] = {
{ "Risqu\u00e9=1", NULL },
{ ",,,=1", NULL },
{ "\xc1=1", NULL },
{ "Foo_Bar=1", NULL },
{ "Fkrkljdsf", NULL }, { "Fkrkljdsf", NULL },
{ "Zn=4294967295", NULL }, { "Zn=4294967295", NULL },
{ "Zn=4294967295-1", NULL }, { "Zn=4294967295-1", NULL },
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment