소스 검색

Reserve enough space for rend_service_port_config_t

In #14803, Damian noticed that his Tor sometimes segfaults. Roger noted
that his valgrind gave an invalid write of size one here. Whenever we
use FLEXIBLE_ARRAY_MEMBER, we have to make sure to actually malloc a
thing that's large enough.

Fixes bug #14803, not in any released version of Tor.
Sebastian Hahn 9 년 전
부모
커밋
37d16c3cc7
1개의 변경된 파일1개의 추가작업 그리고 1개의 파일을 삭제
  1. 1 1
      src/or/rendservice.c

+ 1 - 1
src/or/rendservice.c

@@ -314,7 +314,7 @@ static rend_service_port_config_t *
 rend_service_port_config_new(const char *socket_path)
 {
   if (!socket_path)
-    return tor_malloc_zero(sizeof(rend_service_port_config_t));
+    return tor_malloc_zero(sizeof(rend_service_port_config_t) + 1);
 
   const size_t pathlen = strlen(socket_path) + 1;
   rend_service_port_config_t *conf =