From 8f7940348fcf76596229d67b52e15bf3d9f24852 Mon Sep 17 00:00:00 2001
From: Roger Dingledine <arma@torproject.org>
Date: Sat, 28 Oct 2006 08:17:02 +0000
Subject: Avoid an infinite loop on evil controlport input. Fixes bug 350,
 unless it doesn't. (Nick, please confirm.)

Backport candidate.


svn:r8844
---
 src/or/buffers.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/or/buffers.c b/src/or/buffers.c
index b1f2673c6..421ab4333 100644
--- a/src/or/buffers.c
+++ b/src/or/buffers.c
@@ -1252,7 +1252,7 @@ find_char_on_buf(buf_t *buf, char *start, size_t len, char c)
   size_t len_rest;
   char *cp;
   _split_range(buf, start, &len, &len_rest);
-  cp = memchr(buf->cur, c, len);
+  cp = memchr(start, c, len);
   if (cp || !len_rest)
     return cp;
   return memchr(buf->mem, c, len_rest);
-- 
cgit v1.2.3