| commit | 56a7c5bc15e0447203a491c1ee37de9939ad1dcd | |
| author | David Goulet <dgoulet@torproject.org> | |
| Mon, 5 Jun 2017 15:11:42 +0000 (5 11:11 -0400) | ||
| committer | Nick Mathewson <nickm@torproject.org> | |
| Thu, 8 Jun 2017 13:21:10 +0000 (8 09:21 -0400) | ||
| tree | 56c20372343b1eb11608c76cf2ff786803e1f6bd | treesnapshot (tar.gz zip) |
| parent | 4ee48cb434c46d9e4c477dabd8a97f03e3db221d | commitdiff |
TROVE-2017-005: Fix assertion failure in connection_edge_process_relay_cell
On an hidden service rendezvous circuit, a BEGIN_DIR could be sent
(maliciously) which would trigger a tor_assert() because
connection_edge_process_relay_cell() thought that the circuit is an
or_circuit_t but is an origin circuit in reality.
Fixes #22494
Reported-by: Roger Dingledine <arma@torproject.org>
Signed-off-by: David Goulet <dgoulet@torproject.org>
On an hidden service rendezvous circuit, a BEGIN_DIR could be sent
(maliciously) which would trigger a tor_assert() because
connection_edge_process_relay_cell() thought that the circuit is an
or_circuit_t but is an origin circuit in reality.
Fixes #22494
Reported-by: Roger Dingledine <arma@torproject.org>
Signed-off-by: David Goulet <dgoulet@torproject.org>
| changes/trove-2017-005 | [new file with mode: 0644] | blob |
| src/or/relay.c | diffblobblamehistory |