commit 4a8a1f76ea6cbde128f2cda49049866ea739931d parent c663716b67309f121d0d25ee827fd7ddf339bb8f Author: Nick Mathewson <nickm@torproject.org> Date: Thu, 21 Feb 2019 10:08:14 -0500 Merge branch 'maint-0.3.4' into maint-0.3.5 Diffstat:
| A | changes/ticket29168 | | | 5 | +++++ |
| M | src/core/or/scheduler_kist.c | | | 2 | +- |
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/changes/ticket29168 b/changes/ticket29168 @@ -0,0 +1,5 @@ + o Major bugfixes (cell scheduler, KIST): + - Make KIST to always take into account the outbuf length when computing + what we can actually put in the outbuf. This could lead to the outbuf + being filled up and thus a possible memory DoS vector. TROVE-2019-001. + Fixes bug 29168; bugfix on 0.3.2.1-alpha. diff --git a/src/core/or/scheduler_kist.c b/src/core/or/scheduler_kist.c @@ -286,7 +286,7 @@ update_socket_info_impl, (socket_table_ent_t *ent)) extra_space = clamp_double_to_int64( (ent->cwnd * (int64_t)ent->mss) * sock_buf_size_factor) - - ent->notsent; + ent->notsent - (int64_t)channel_outbuf_length((channel_t *) ent->chan); if ((tcp_space + extra_space) < 0) { /* This means that the "notsent" queue is just too big so we shouldn't put * more in the kernel for now. */