Unverified Commit e0f9a822 authored by teor's avatar teor
Browse files

Merge remote-tracking branch 'tor-github/pr/1229' into maint-0.2.9

parents c35aded0 37bd7fa5

changes/bug30041

0 → 100644
+5 −0
Original line number Diff line number Diff line 
  o Minor bugfixes (hardening):

    - Verify in more places that we are not about to create a buffer

      with more than INT_MAX bytes, to avoid possible OOB access in the event

      of bugs.  Fixes bug 30041; bugfix on 0.2.0.16.  Found and fixed by

      Tobias Stoeckmann.

src/or/buffers.c

+3 −1
Original line number Diff line number Diff line
@@ -1034,6 +1034,7 @@ buf_find_pos_of_char(char ch, buf_pos_t *out) 
static inline int

buf_pos_inc(buf_pos_t *pos)

{

  tor_assert(pos->pos < INT_MAX - 1);

  ++pos->pos;

  if (pos->pos == (off_t)pos->chunk->datalen) {

    if (!pos->chunk->next)
@@ -1925,6 +1926,7 @@ buf_find_offset_of_char(buf_t *buf, char ch) 
{

  chunk_t *chunk;

  off_t offset = 0;

  tor_assert(buf->datalen < INT_MAX);

  for (chunk = buf->head; chunk; chunk = chunk->next) {

    char *cp = memchr(chunk->data, ch, chunk->datalen);

    if (cp)
@@ -2044,6 +2046,7 @@ assert_buf_ok(buf_t *buf) 
    for (ch = buf->head; ch; ch = ch->next) {

      total += ch->datalen;

      tor_assert(ch->datalen <= ch->memlen);

      tor_assert(ch->datalen < INT_MAX);

      tor_assert(ch->data >= &ch->mem[0]);

      tor_assert(ch->data <= &ch->mem[0]+ch->memlen);

      if (ch->data == &ch->mem[0]+ch->memlen) {
@@ -2060,4 +2063,3 @@ assert_buf_ok(buf_t *buf) 
    tor_assert(buf->datalen == total);

  }

}

src/or/connection.c

+4 −0
Original line number Diff line number Diff line
@@ -3581,6 +3581,10 @@ connection_read_to_buf(connection_t *conn, ssize_t *max_to_read, 
    if (conn->linked_conn) {

      result = move_buf_to_buf(conn->inbuf, conn->linked_conn->outbuf,

                               &conn->linked_conn->outbuf_flushlen);

      if (BUG(result<0)) {

        log_warn(LD_BUG, "reading from linked connection buffer failed.");

        return -1;

      }

    } else {

      result = 0;

    }