Check return value of buf_move_to_buf for error.
commit0fa95308fe5fcce8842530fcae5a49188856e6ac
authorTobias Stoeckmann <tobias@stoeckmann.org>
Sun, 31 Mar 2019 15:33:11 +0000 (31 17:33 +0200)
committerNick Mathewson <nickm@torproject.org>
Tue, 9 Apr 2019 16:00:14 +0000 (9 12:00 -0400)
treec90023be639e3c7299e3fbec9b364ad0d1a2144e
parent74b2bc43fbe61e3a04fe3f5cc9f817be307e13e1
Check return value of buf_move_to_buf for error.

If the concatenation of connection buffer and the buffer of linked
connection exceeds INT_MAX bytes, then buf_move_to_buf returns -1 as an
error value.

This value is currently casted to size_t (variable n_read) and will
erroneously lead to an increasement of variable "max_to_read".

This in turn can be used to call connection_buf_read_from_socket to
store more data inside the buffer than expected and clogging the
connection buffer.

If the linked connection buffer was able to overflow INT_MAX, the call
of buf_move_to_buf would have previously internally triggered an integer
overflow, corrupting the state of the connection buffer.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
src/or/connection.c