aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNick Mathewson <nickm@torproject.org>2011-12-15 11:32:49 -0500
committerNick Mathewson <nickm@torproject.org>2011-12-15 11:32:49 -0500
commite402edd96064ae853767dff459da2646bc70af5e (patch)
tree3906d58188766d99c6d497ea7cc48341a77c8043
parent960f62bd82c249b456a0aa2e1ae62f68c754aacb (diff)
parent562c974ee7913b09bc1b19e4674dea618f2c6328 (diff)
downloadtor-e402edd96064ae853767dff459da2646bc70af5e.tar
tor-e402edd96064ae853767dff459da2646bc70af5e.tar.gz
Merge remote-tracking branch 'origin/maint-0.2.2'
-rw-r--r--changes/buffer_bug7
-rw-r--r--src/or/buffers.c5
2 files changed, 10 insertions, 2 deletions
diff --git a/changes/buffer_bug b/changes/buffer_bug
new file mode 100644
index 000000000..634f60953
--- /dev/null
+++ b/changes/buffer_bug
@@ -0,0 +1,7 @@
+
+ o Major bugfixes:
+ - Fix a heap overflow bug that could occur when trying to pull
+ data into the first chunk of a buffer, when that chunk had
+ already had some data drained from it. Fixes CVE-2011-2778;
+ bugfix on 0.2.0.16-alpha. Reported by "Vektor".
+
diff --git a/src/or/buffers.c b/src/or/buffers.c
index f4aac0f0e..7c49423e1 100644
--- a/src/or/buffers.c
+++ b/src/or/buffers.c
@@ -401,9 +401,10 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate)
if (buf->head->memlen >= capacity) {
/* We don't need to grow the first chunk, but we might need to repack it.*/
- if (CHUNK_REMAINING_CAPACITY(buf->head) < capacity-buf->datalen)
+ size_t needed = capacity - buf->head->datalen;
+ if (CHUNK_REMAINING_CAPACITY(buf->head) < needed)
chunk_repack(buf->head);
- tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= capacity-buf->datalen);
+ tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= needed);
} else {
chunk_t *newhead;
size_t newsize;