tor

commit 65f2eec694f18a64291cc85317b9f22dacc1d8e4
parent cb92d47deca15c44dd52cad6fc326520648c632e
Author: Nick Mathewson <nickm@torproject.org>
Date:   Thu,  1 Feb 2018 16:33:52 -0500

Correctly handle NULL returns from parse_protocol_list when voting.

In some cases we had checked for it, but in others we had not.  One
of these cases could have been used to remotely cause
denial-of-service against directory authorities while they attempted
to vote.

Fixes TROVE-2018-001.

Diffstat:
A
changes/trove-2018-001.1
 | 
6
++++++
M
src/or/protover.c
 | 
6
++++++

2 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/changes/trove-2018-001.1 b/changes/trove-2018-001.1
@@ -0,0 +1,6 @@
+  o Major bugfixes (denial-of-service, directory authority):
+    - Fix a protocol-list handling bug that could be used to remotely crash
+      directory authorities with a null-pointer exception. Fixes bug 25074;
+      bugfix on 0.2.9.4-alpha. Also tracked as TROVE-2018-001.
+
+
diff --git a/src/or/protover.c b/src/or/protover.c
@@ -554,6 +554,12 @@ protover_compute_vote(const smartlist_t *list_of_proto_strings,
   // First, parse the inputs and break them into singleton entries.
   SMARTLIST_FOREACH_BEGIN(list_of_proto_strings, const char *, vote) {
     smartlist_t *unexpanded = parse_protocol_list(vote);
+    if (! unexpanded) {
+      log_warn(LD_NET, "I failed with parsing a protocol list from "
+               "an authority. The offending string was: %s",
+               escaped(vote));
+      continue;
+    }
     smartlist_t *this_vote = expand_protocol_list(unexpanded);
     if (this_vote == NULL) {
       log_warn(LD_NET, "When expanding a protocol list from an authority, I "