control: HSFETCH command fails to validate v2 addresses
In handle_control_hsfetch()
:
} else if (strcmpstart(arg1, v2_str) == 0 &&
rend_valid_descriptor_id(arg1 + v2_str_len) &&
base32_decode(digest, sizeof(digest), arg1 + v2_str_len,
REND_DESC_ID_V2_LEN_BASE32) ==
REND_DESC_ID_V2_LEN_BASE32) {
The above snippet is how we validate the v2 address for the HSFETCH
command. The base32_decode()
function returns the number of bytes decoded and thus it should returns on success sizeof(digest)
, not the total length of the base32 address (20 vs 32).
Issue was introduced in commit a517daa56f5848d25ba79617a1a7b82ed2b0a7c0
meaning since 0.4.1.1-alpha (ticket legacy/trac#28913 (moved)).
I noticed this because I recently updated the bad HSDirscanner Tor to use our latest and it broke the scanner.