Commit 890ae4fb authored by Nick Mathewson's avatar Nick Mathewson 🐘
Browse files

Fix detection of point to insert signatures on a pending consensus. 

We were looking for the first instance of "directory-signature "
when instead the correct behavior is to look for the first instance
of "directory-signature " at the start of a line.

Unfortunately, this can be exploited as to crash authorities while
they're voting.

Fixes #40316; bugfix on 0.2.2.4-alpha.  This is TROVE-2021-002,
also tracked as CVE-2021-28090.
parent 296a557b

changes/bug40316

0 → 100644
+5 −0
Changes for changes/bug40316: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line 
  o Major bugfixes (security, denial of service):

    - Fix a bug in appending detached signatures to a pending consensus

      document that could be used to crash a directory authority.

      Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as

      TROVE-2021-002 and CVE-2021-28090.

src/feature/dirauth/dirvote.c

+1 −1
Changes for src/feature/dirauth/dirvote.c: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -3520,7 +3520,7 @@ dirvote_add_signatures_to_pending_consensus( 
      strlen(pc->body) + strlen(new_signatures) + 1;

    pc->body = tor_realloc(pc->body, new_consensus_len);

    dst_end = pc->body + new_consensus_len;

    dst = strstr(pc->body, "directory-signature ");

    dst = (char *) find_str_at_start_of_line(pc->body, "directory-signature ");

    tor_assert(dst);

    strlcpy(dst, new_signatures, dst_end-dst);