@@ -0,0 +1,6 @@
+ o Minor bugfixes (fuzzing):
+ - Fix a bug in our fuzzing mock replacement for crypto_pk_checksig(), to
+ correctly handle cases where a caller gives it an RSA key of under 160
+ bits. (This is not actually a bug in Tor itself, but wrather in our
+ fuzzing code.) Fixes bug 24247; bugfix on 0.3.0.3-alpha.
+ Found by OSS-Fuzz as issue 4177.
@@ -25,8 +25,9 @@ mock_crypto_pk_public_checksig__nocheck(const crypto_pk_t *env, char *to,
(void)fromlen;
/* We could look at from[0..fromlen-1] ... */
tor_assert(tolen >= crypto_pk_keysize(env));
- memset(to, 0x01, 20);
- return 20;
+ size_t siglen = MIN(20, crypto_pk_keysize(env));
+ memset(to, 0x01, siglen);
+ return (int)siglen;
}
static int