Commit c4742b89 authored by Nick Mathewson's avatar Nick Mathewson 🌻
Browse files

Fix a bug in buf_move_all() when the input buffer is empty.

We found this in #40076, after we started using buf_move_all() in
more places.  Fixes bug #40076; bugfix on  As far as
I know, the crash only affects master, but I think this warrants a
backport, "just in case".
parent 0a588821
o Minor bugfixes (correctness, buffers):
- Fix a correctness bug that could cause an assertion failure if we ever
tried using the buf_move_all() function with an empty input.
As far as we know, no released versions of Tor do this.
Fixes bug 40076; bugfix on
......@@ -689,6 +689,8 @@ buf_move_all(buf_t *buf_out, buf_t *buf_in)
if (!buf_in)
if (buf_datalen(buf_in) == 0)
if (BUG(buf_out->datalen >= INT_MAX || buf_in->datalen >= INT_MAX))
if (BUG(buf_out->datalen >= INT_MAX - buf_in->datalen))
......@@ -310,7 +310,6 @@ test_buffers_move_all(void *arg)
buf_t *output = buf_new();
char *s = NULL;
#if 0
/* Move from empty buffer to nonempty buffer. (This is a regression test for
* #40076) */
buf_add(output, "abc", 3);
......@@ -329,7 +328,6 @@ test_buffers_move_all(void *arg)
/* Move from empty to empty. */
output = buf_new();
input = buf_new();
buf_move_all(output, input);
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment