Skip to content

Commit 5cca245

Browse files
committed
cleanup: Check that onion IP/Port packing worked.
If it doesn't work for some reason, right now it would cause trouble (e.g. buffer overrun).
1 parent e092ecd commit 5cca245

File tree

2 files changed

+10
-0
lines changed

2 files changed

+10
-0
lines changed

toxcore/onion_announce.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -511,6 +511,11 @@ static int handle_announce_request_common(
511511
uint8_t ping_id_data[CRYPTO_PUBLIC_KEY_SIZE + SIZE_IPPORT];
512512
memcpy(ping_id_data, packet_public_key, CRYPTO_PUBLIC_KEY_SIZE);
513513
const int packed_len = pack_ip_port(onion_a->log, &ping_id_data[CRYPTO_PUBLIC_KEY_SIZE], SIZE_IPPORT, source);
514+
if (packed_len < 0) {
515+
LOGGER_ERROR(onion_a->log, "failed to pack IP/Port");
516+
mem_delete(onion_a->mem, plain);
517+
return 1;
518+
}
514519
assert(packed_len <= SIZE_IPPORT);
515520
memzero(&ping_id_data[CRYPTO_PUBLIC_KEY_SIZE + packed_len], SIZE_IPPORT - packed_len);
516521
const uint8_t *data_public_key = plain + ONION_PING_ID_SIZE + CRYPTO_PUBLIC_KEY_SIZE;

toxcore/onion_client.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -580,6 +580,11 @@ static int new_sendback(Onion_Client *onion_c, uint32_t num, const uint8_t *publ
580580
memcpy(data, &num, sizeof(uint32_t));
581581
memcpy(&data[sizeof(uint32_t)], public_key, CRYPTO_PUBLIC_KEY_SIZE);
582582
const int packed_len = pack_ip_port(onion_c->logger, &data[sizeof(uint32_t) + CRYPTO_PUBLIC_KEY_SIZE], SIZE_IPPORT, ip_port);
583+
if (packed_len < 0) {
584+
LOGGER_ERROR(onion_c->logger, "failed to pack IP/port");
585+
return -1;
586+
}
587+
assert(packed_len <= SIZE_IPPORT);
583588
memzero(&data[sizeof(uint32_t) + CRYPTO_PUBLIC_KEY_SIZE + packed_len], SIZE_IPPORT - packed_len);
584589
memcpy(&data[sizeof(uint32_t) + CRYPTO_PUBLIC_KEY_SIZE + SIZE_IPPORT], &path_num, sizeof(uint32_t));
585590
*sendback = ping_array_add(onion_c->announce_ping_array, onion_c->mono_time, onion_c->rng, data, sizeof(data));

0 commit comments

Comments
 (0)