[tor-commits] [tor/release-0.2.6] Do not leave empty, invalid chunks in buffers during buf_pullup

[nickm@xxxxxxxxxxxxxx]

commit 71ee53fe9bdf3f64eef9b38de55960185e8be1b5
Author: Nick Mathewson <nickm@xxxxxxxxxxxxxx>
Date:   Tue Mar 3 22:20:17 2015 +0100

    Do not leave empty, invalid chunks in buffers during buf_pullup
    
    This fixes an assertion failure bug in 15083; bugfix on 0.2.0.10-alpha.
    
    Patch from 'cypherpunks'
---
 changes/bug15083 |    6 ++++++
 src/or/buffers.c |    2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/changes/bug15083 b/changes/bug15083
new file mode 100644
index 0000000..98d1d0e
--- /dev/null
+++ b/changes/bug15083
@@ -0,0 +1,6 @@
+  o Major bugfixes (relay, stability):
+    - Fix a bug that could lead to a relay crashing with an assertion
+      failure if a buffer of exactly the wrong layout was passed
+      to buf_pullup() at exactly the wrong time. Fixes bug 15083;
+      bugfix on 0.2.0.10-alpha. Patch from 'cypherpunks'.
+   
diff --git a/src/or/buffers.c b/src/or/buffers.c
index 9be0476..7976432 100644
--- a/src/or/buffers.c
+++ b/src/or/buffers.c
@@ -426,7 +426,7 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate)
     size_t n = bytes - dest->datalen;
     src = dest->next;
     tor_assert(src);
-    if (n > src->datalen) {
+    if (n >= src->datalen) {
       memcpy(CHUNK_WRITE_PTR(dest), src->data, src->datalen);
       dest->datalen += src->datalen;
       dest->next = src->next;



_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits