[or-cvs] patch the rh.length bug

[arma@xxxxxxxx]

Update of /home/or/cvsroot/tor/src/or
In directory moria:/home/arma/work/onion/00910/tor/src/or

Modified Files:
      Tag: tor-0_0_9-patches
	relay.c 
Log Message:
patch the rh.length bug


Index: relay.c
===================================================================
RCS file: /home/or/cvsroot/tor/src/or/relay.c,v
retrieving revision 1.32.2.4
retrieving revision 1.32.2.5
diff -u -d -r1.32.2.4 -r1.32.2.5
--- relay.c	24 Mar 2005 21:30:33 -0000	1.32.2.4
+++ relay.c	16 Jun 2005 20:50:34 -0000	1.32.2.5
@@ -660,6 +660,11 @@
   num_seen++;
   log_fn(LOG_DEBUG,"Now seen %d relay cells here.", num_seen);
 
+  if (rh.length > RELAY_PAYLOAD_SIZE) {
+    log_fn(LOG_WARN, "Relay cell length field too long. Closing circuit.");
+    return -1;
+  }
+
   /* either conn is NULL, in which case we've got a control cell, or else
    * conn points to the recognized stream. */