[tor-commits] [tor/master] Don't crash on malformed EXTENDCIRCUIT.

[nickm@xxxxxxxxxxxxxx]

commit 6d6643298dfda1b146c635e3858faec7e9c9631c
Author: Nick Mathewson <nickm@xxxxxxxxxxxxxx>
Date:   Tue Jan 6 08:49:57 2015 -0500

    Don't crash on malformed EXTENDCIRCUIT.
    
    Fixes 14116; bugfix on ac68704f in 0.2.2.9-alpha.
---
 changes/bug14116_025 |    3 +++
 src/or/control.c     |    8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/changes/bug14116_025 b/changes/bug14116_025
new file mode 100644
index 0000000..0859f62
--- /dev/null
+++ b/changes/bug14116_025
@@ -0,0 +1,3 @@
+  o Minor bugfixes (controller):
+    - Avoid crashing on a malformed EXTENDCIRCUIT command. Fixes bug 14116;
+      bugfix on 0.2.2.9-alpha.
diff --git a/src/or/control.c b/src/or/control.c
index 9378f38..bdd91fc 100644
--- a/src/or/control.c
+++ b/src/or/control.c
@@ -2451,6 +2451,14 @@ handle_control_extendcircuit(control_connection_t *conn, uint32_t len,
     goto done;
   }
 
+  if (smartlist_len(args) < 2) {
+    connection_printf_to_buf(conn,
+                             "512 syntax error: not enough arguments.\r\n");
+    SMARTLIST_FOREACH(args, char *, cp, tor_free(cp));
+    smartlist_free(args);
+    goto done;
+  }
+
   smartlist_split_string(router_nicknames, smartlist_get(args,1), ",", 0, 0);
 
   SMARTLIST_FOREACH(args, char *, cp, tor_free(cp));



_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits