[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #20894 [Core Tor/Tor]: Resolve read-off-end-of-buffer on atoi in fetch_from_buf_http (TROVE-2016-10-001)
#20894: Resolve read-off-end-of-buffer on atoi in fetch_from_buf_http
(TROVE-2016-10-001)
---------------------------------------+-----------------------------------
Reporter: teor | Owner: nickm
Type: defect | Status: needs_revision
Priority: High | Milestone: Tor:
| 0.3.0.x-final
Component: Core Tor/Tor | Version: Tor: unspecified
Severity: Normal | Resolution:
Keywords: tor-03-unspecified-201612 | Actual Points:
Parent ID: | Points: 0.5
Reviewer: | Sponsor:
---------------------------------------+-----------------------------------
Changes (by teor):
* status: needs_review => needs_revision
Comment:
Can `headers+headerlen` can wrap here?
If so, we also need:
`tor_assert(headers < SIZE_T_MAX - headerlen);`
Before every time we do `headers+headerlen`.
(And before:
`p = (char*) tor_memstr(headers, headerlen, CONTENT_LENGTH);`
which effectively does `headers+headerlen`.)
Please credit AFL in the changes file:
Discovered by fuzzing using AFL: http://lcamtuf.coredump.cx/afl/
Replying to [ticket:20894 teor]:
> It would be nice to email the maintainer with this ticket number and let
them know, so they can add it to their gallery.
I emailed the AFL maintainer today and CC'd tor-team.
This bug is now linked from http://lcamtuf.coredump.cx/afl/
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20894#comment:8>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs