[tor-bugs] #5647 [Tor Hidden Services]: rend_parse_client_keys() prints stack in logs if base64_decode fails

["Tor Bug Tracker & Wiki" <torproject-admin@xxxxxxxxxxxxxx>]

#5647: rend_parse_client_keys() prints stack in logs if base64_decode fails
---------------------------------+------------------------------------------
 Reporter:  asn                  |          Owner:                  
     Type:  defect               |         Status:  new             
 Priority:  normal               |      Milestone:  Tor: unspecified
Component:  Tor Hidden Services  |        Version:                  
 Keywords:                       |         Parent:                  
   Points:                       |   Actualpoints:                  
---------------------------------+------------------------------------------
 {{{
 int
 rend_parse_client_keys(strmap_t *parsed_clients, const char *ckstr)
 {
 ...
     char descriptor_cookie_base64[REND_DESC_COOKIE_LEN_BASE64+2+1];
 ...
     /* The size of descriptor_cookie_tmp needs to be
 REND_DESC_COOKIE_LEN+2,
      * because a base64 encoding of length 24 does not fit into 16 bytes
 in all
      * cases. */
     if ((base64_decode(descriptor_cookie_tmp, REND_DESC_COOKIE_LEN+2,
                        tok->args[0], REND_DESC_COOKIE_LEN_BASE64+2+1)
            != REND_DESC_COOKIE_LEN)) {
       log_warn(LD_REND, "Descriptor cookie contains illegal characters: "
                         "%s", descriptor_cookie_base64);
       goto err;
     }
 ...
 }}}

 `descriptor_cookie_base64` was never initialized, so it upon
 base64_decode() failure, it prints stack garbage to the logs.

 Not an important bug, but a bug alright, so I'm putting it here to not
 forget it.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5647>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs