Skip to content
Snippets Groups Projects
Commit 0fa95308 authored by Tobias Stoeckmann's avatar Tobias Stoeckmann Committed by Nick Mathewson
Browse files

Check return value of buf_move_to_buf for error.


If the concatenation of connection buffer and the buffer of linked
connection exceeds INT_MAX bytes, then buf_move_to_buf returns -1 as an
error value.

This value is currently casted to size_t (variable n_read) and will
erroneously lead to an increasement of variable "max_to_read".

This in turn can be used to call connection_buf_read_from_socket to
store more data inside the buffer than expected and clogging the
connection buffer.

If the linked connection buffer was able to overflow INT_MAX, the call
of buf_move_to_buf would have previously internally triggered an integer
overflow, corrupting the state of the connection buffer.

Signed-off-by: default avatarTobias Stoeckmann <tobias@stoeckmann.org>
parent 74b2bc43
Branches
Tags
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment