Opened 5 years ago

Closed 5 years ago

#18383 closed defect (duplicate)

common_digests_t loops should be N_COMMON_DIGEST_ALGORITHMS

Reported by: teor Owned by:
Priority: Very High Milestone: Tor: 0.2.8.x-final
Component: Core Tor/Tor Version:
Severity: Critical Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:


networkstatus_get_detached_signatures and networkstatus_add_detached_signatures use N_DIGEST_ALGORITHMS as a loop counter for common_digests_t, when it should use N_COMMON_DIGEST_ALGORITHMS.

This reads or writes memory out of array bounds on directory authorities.

Child Tickets

Change History (3)

comment:1 Changed 5 years ago by teor

Status: newneeds_revision

My branch bug18383 has these fixes but no changes file. I think it was introduced in 0.2.8, but we should check and backport accordingly.

comment:2 Changed 5 years ago by cypherpunks

comment:3 Changed 5 years ago by nickm

Resolution: duplicate
Status: needs_revisionclosed

Closing as duplicate of #18380. Please reopen if I'm wrong?

Note: See TracTickets for help on using tickets.