Out-of-bounds

The networkstatusparsevotefromstring function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service out-of-bounds read and daemon crash via a crafted 1 vote document or 2 consensus document...