'buf_read_from_tls()' can return the wrong error code
The function buf_read_from_tls(...)
returns an integer. This integer can either be <=0
(in which case it corresponds to a TOR_TLS_
status) or a positive number (in which case it corresponds to the number of bytes read). This return value is used in connection_buf_read_from_socket()
in a large switch(result)
statement.
At the beginning of buf_read_from_tls(...)
, it returns -1
on the lines:
IF_BUG_ONCE(buf->datalen >= INT_MAX)
return -1;
IF_BUG_ONCE(buf->datalen >= INT_MAX - at_most)
return -1;
This value of -1
is the same as TOR_TLS_WANTWRITE
. This causes the switch statement in connection_buf_read_from_socket()
to interpret the return value as TOR_TLS_WANTWRITE
, which is not correct for the buf->datalen >= INT_MAX
bug. I suggest returning TOR_TLS_ERROR_MISC
instead of -1
. Note that this would close the connection.
I don't think you'll see incorrect behavior due to this, but it might be a good idea to fix.