GitLab

Tor 0.2.2.32 dies in assert on reloading config or control/SETCONF TrackExitHosts=... when some exit hosts was tracked before. Log:

Sep 04 xx:xx:xx.xxx [err] _tor_strndup(): Bug: util.c:226: _tor_strndup: Assertion n < SIZE_T_CEILING failed; aborting.

Backtrace:

#1  0xb7cb8811 in raise () from /lib/tls/i686/cmov/libc.so.6
#2  0xb7cb9fb9 in abort () from /lib/tls/i686/cmov/libc.so.6
#3  0x081071e1 in _tor_strndup (s=0x85a0481 "exit", n=4294967295) at util.c:226
#4  0x080c3d73 in addressmap_clear_excluded_trackexithosts (options=0x84a6898)
    at connection_edge.c:849
#5  0x080b45d0 in options_act (old_options=0x816ccf0) at config.c:1328
#6  0x080b5753 in set_options (new_val=0x84a6898, msg=0xbffffaf8)
    at config.c:674
#7  0x080b5e91 in options_init_from_string (
    cf=0x89ef858 "## Configuration file "..., 
    command=0, command_arg=0x0, msg=0xbffffaf8) at config.c:4279
#8  0x080b6325 in options_init_from_torrc (argc=1, argv=0xbffffd64)
    at config.c:4153
#9  0x080500e7 in process_signal (sig=1) at main.c:1428
#10 0xb7f5ec23 in event_base_loop () from /usr/lib/libevent-2.0.so.5
...

Function addressmap_clear_excluded_trackexithosts seems broken in lines 845-850, strrchr(3) does not work like this. Patch attached.

Trac:
Username: laruldan