#19066: Wrong length used in networkstatus_parse_detached_signatures ------------------------------+-------------------------------- Reporter: dgoulet | Owner: dgoulet Type: defect | Status: new Priority: Medium | Milestone: Tor: 0.2.9.x-final Component: Core Tor/Tor | Version: Severity: Normal | Keywords: Actual Points: | Parent ID: Points: | Reviewer: Sponsor: | ------------------------------+-------------------------------- While fixing #14013, nikkolasg realized thatif we did in fact use `!= DIGEST256_LEN` it caused a failure in the test:
{{{ // XXX Should it not be always DIGEST256_LEN ? Running the tests with // the condition ` != DIGEST256_LEN` fails. if (base16_decode(digests->d[alg], DIGEST256_LEN, hexdigest, strlen(hexdigest)) < 0) { }}} Turns out that `alg` here is actually `sha1` thus of size `DIGEST_LEN`. The base16 decode is safe with a larger length but this check (just above in the code) could resolved in unwanted behavior: {{{ if (!tor_mem_is_zero(digests->d[alg], DIGEST256_LEN)) { }}} `tor_mem_is_zero` does make sure that the full length is zeroes thus here looking for 12 extra bytes out of bound to be 0... (DIGEST_LEN vs DIGEST256_LEN). The length we used should be set according to the algorithm in `alg` Patch coming soon. -- Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19066> Tor Bug Tracker & Wiki <https://trac.torproject.org/> The Tor Project: anonymity online _______________________________________________ tor-bugs mailing list tor-bugs@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs