Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Corrupted RouterInfo's will crash i2pd #26

Closed
meeh420 opened this issue Feb 2, 2014 · 4 comments
Closed

Corrupted RouterInfo's will crash i2pd #26

meeh420 opened this issue Feb 2, 2014 · 4 comments

Comments

@meeh420
Copy link
Contributor

meeh420 commented Feb 2, 2014

Tried to find exception, or error handling in CryptoPP. No luck.

Maybe verify data before Verifier::VerifyMessage ?

GDB backtrace.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7a4efe0 in CryptoPP::IteratedHashBase<unsigned int, CryptoPP::HashTransformation>::HashMultipleBlocks(unsigned int const*, unsigned long) () from /usr/lib/libcrypto++.so.9
(gdb) bt
#0  0x00007ffff7a4efe0 in CryptoPP::IteratedHashBase<unsigned int, CryptoPP::HashTransformation>::HashMultipleBlocks(unsigned int const*, unsigned long) () from /usr/lib/libcrypto++.so.9
#1  0x00007ffff7a4f83c in CryptoPP::IteratedHashBase<unsigned int, CryptoPP::HashTransformation>::Update(unsigned char const*, unsigned long) () from /usr/lib/libcrypto++.so.9
#2  0x000000000043b990 in CryptoPP::PK_MessageAccumulatorBase::Update (this=0x76c4a0, input=0x76b0f0 "", length=18446744073709551576)
    at /usr/include/cryptopp/pubkey.h:292
#3  0x00007ffff799ce2c in CryptoPP::PK_Verifier::VerifyMessage(unsigned char const*, unsigned long, unsigned char const*, unsigned long) const () from /usr/lib/libcrypto++.so.9
#4  0x000000000045c3fc in i2p::data::RouterInfo::ReadFromBuffer (this=0x76aef0) at RouterInfo.cpp:74
#5  0x000000000045c192 in i2p::data::RouterInfo::ReadFromFile (this=0x76aef0, 
    filename=0x754898 "/home/meeh/.i2pd/netDb/rt/routerInfo-tNtnzINKGef6lVhj0BlM-t8-~8iW6~g249w7~KwJegQ=.dat") at RouterInfo.cpp:54
#6  0x000000000045be68 in i2p::data::RouterInfo::RouterInfo (this=0x76aef0, 
    filename=0x754898 "/home/meeh/.i2pd/netDb/rt/routerInfo-tNtnzINKGef6lVhj0BlM-t8-~8iW6~g249w7~KwJegQ=.dat") at RouterInfo.cpp:23
#7  0x000000000046fea9 in i2p::data::NetDb::Load (this=0x74b4e0 <i2p::data::netdb>, 
    directory=0x4d6bf0 <i2p::data::NetDb::m_NetDbPath> "/netDb") at NetDb.cpp:243
#8  0x000000000046f2e0 in i2p::data::NetDb::Start (this=0x74b4e0 <i2p::data::netdb>) at NetDb.cpp:69
#9  0x0000000000433d3b in main (argc=1, argv=0x7fffffffe028) at i2p.cpp:42
(gdb) f
#0  0x00007ffff7a4efe0 in CryptoPP::IteratedHashBase<unsigned int, CryptoPP::HashTransformation>::HashMultipleBlocks(unsigned int const*, unsigned long) () from /usr/lib/libcrypto++.so.9
@orignal
Copy link
Contributor

orignal commented Feb 2, 2014

Yes, I have noticed it. Usually it happens if file is zero length, I just delete such files.
Basically this line causes the problem:
int l = m_BufferLen - 40;
l might be negative, that's not supposed to.

@meeh420
Copy link
Contributor Author

meeh420 commented Feb 2, 2014

Maybe we should set this. Not sure if it helps much doh.

if (l < 0)
    l = 0;

@orignal
Copy link
Contributor

orignal commented Feb 2, 2014

line 48 m_BufferLen = s.tellg ();
if (m_BufleLen < 40)
{
LogPrint ("File ", filename, " is malformed");
return;
}

@meeh420
Copy link
Contributor Author

meeh420 commented Feb 2, 2014

ok, pull request :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants