From d5161ab895b9c14a66a08fb38521dd12c0772a97 Mon Sep 17 00:00:00 2001
From: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Date: Sun, 6 Nov 2011 17:23:14 +0100
Subject: Fix remotely triggerable assert during ip decryption

Fixes bug 4410.
---
 src/or/routerparse.c | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'src/or/routerparse.c')

diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index 19f9e38a9..843fc79c8 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -3858,6 +3858,11 @@ rend_decrypt_introduction_points(char **ipos_decrypted,
     crypto_cipher_env_t *cipher;
     char *dec;
     int declen;
+    if (ipos_encrypted_size < CIPHER_IV_LEN + 2) {
+      log_warn(LD_REND, "Size of encrypted introduction points is too "
+                        "small.");
+      return -1;
+    }
     dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1);
     cipher = crypto_create_init_cipher(descriptor_cookie, 0);
     declen = crypto_cipher_decrypt_with_iv(cipher, dec,
-- 
cgit v1.2.3