Browse Source

Detect insanely large circuit build state; don't give its length to rand_int

Nick Mathewson 13 years ago
parent
commit
42e4e156d9
2 changed files with 13 additions and 1 deletions
  1. 4 0
      changes/bug3306
  2. 9 1
      src/or/circuitbuild.c

+ 4 - 0
changes/bug3306

@@ -3,3 +3,7 @@
       correctly. Previously, it accepted values up to UINT_MAX, but
       could return a negative number if given a value above INT_MAX+1.
       Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14.
+
+    - Avoid a segfault when reading a malformed circuit build state
+      with more than INT_MAX entries. Found by wanoskarnet. Bugfix on
+      0.2.2.4-alpha.

+ 9 - 1
src/or/circuitbuild.c

@@ -678,7 +678,15 @@ circuit_build_times_shuffle_and_store_array(circuit_build_times_t *cbt,
     log_notice(LD_CIRC, "The number of circuit times that this Tor version "
                "uses to calculate build times is less than the number stored "
                "in your state file. Decreasing the circuit time history from "
-               "%d to %d.", num_times, CBT_NCIRCUITS_TO_OBSERVE);
+               "%lu to %d.", (unsigned long)num_times,
+               CBT_NCIRCUITS_TO_OBSERVE);
+  }
+
+  if (n > INT_MAX-1) {
+    log_warn(LD_CIRC, "For some insane reasons, you had %lu circuit build "
+             "observations in your state file. That's far too many; probably "
+             "there's a bug here.", (unsigned long)n);
+    n = INT_MAX-1;
   }
 
   /* This code can only be run on a compact array */