Explorar o código

SOCKS: Always free username/password before setting them.

This fixes a memory leak found by fuzzing.
Nick Mathewson %!s(int64=5) %!d(string=hai) anos
pai
achega
04512d9fcd
Modificáronse 1 ficheiros con 3 adicións e 0 borrados
  1. 3 0
      src/core/proto/proto_socks.c

+ 3 - 0
src/core/proto/proto_socks.c

@@ -174,6 +174,7 @@ parse_socks4_request(const uint8_t *raw_data, socks_request_t *req,
       goto end;
       goto end;
     }
     }
 
 
+    tor_free(req->username);
     req->got_auth = 1;
     req->got_auth = 1;
     req->username = tor_strdup(username);
     req->username = tor_strdup(username);
     req->usernamelen = usernamelen;
     req->usernamelen = usernamelen;
@@ -445,6 +446,7 @@ parse_socks5_userpass_auth(const uint8_t *raw_data, socks_request_t *req,
    socks5_client_userpass_auth_getconstarray_passwd(trunnel_req);
    socks5_client_userpass_auth_getconstarray_passwd(trunnel_req);
 
 
   if (usernamelen && username) {
   if (usernamelen && username) {
+    tor_free(req->username);
     req->username = tor_memdup_nulterm(username, usernamelen);
     req->username = tor_memdup_nulterm(username, usernamelen);
     req->usernamelen = usernamelen;
     req->usernamelen = usernamelen;
 
 
@@ -452,6 +454,7 @@ parse_socks5_userpass_auth(const uint8_t *raw_data, socks_request_t *req,
   }
   }
 
 
   if (passwordlen && password) {
   if (passwordlen && password) {
+    tor_free(req->password);
     req->password = tor_memdup_nulterm(password, passwordlen);
     req->password = tor_memdup_nulterm(password, passwordlen);
     req->passwordlen = passwordlen;
     req->passwordlen = passwordlen;