[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-bugs] #5541 [Tor Relay]: NULL ptr deref. in connection_edge_process_relay_cell()

#5541: NULL ptr deref. in connection_edge_process_relay_cell()
-----------------------+----------------------------------------------------
 Reporter:  asn        |          Owner:                    
     Type:  defect     |         Status:  new               
 Priority:  normal     |      Milestone:  Tor: 0.2.3.x-final
Component:  Tor Relay  |        Version:                    
 Keywords:             |         Parent:                    
   Points:             |   Actualpoints:                    
-----------------------+----------------------------------------------------
 In `connection_edge_process_relay_cell()`, if `conn` is `NULL` (because
 `!rh.stream_id` in `relay_lookup_conn()`), and the cell command is
 `RELAY_COMMAND_DATA`; if it gets inside:
 {{{
       if (( layer_hint && --layer_hint->deliver_window < 0) ||
           (!layer_hint && --circ->deliver_window < 0)) {
 }}}
 it can cause a NULL pointer dereference in `connection_edge_end()`, since
 the check for `(!conn)` happens after that `if` statement.

 I suspect that this can be triggered if you spam an OR to reduce its
 `deliver_window` to 0, and then send a `RELAY_COMMAND_DATA` cell with no
 `stream_id`.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5541>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs