Unverified Commit 9be65c44 authored by teor's avatar teor
Browse files

Merge remote-tracking branch 'tor-github/pr/926' into maint-0.3.5

parents 955cf962 2cdc6b20

changes/bug30040

0 → 100644
+9 −0
Original line number Diff line number Diff line 
  o Minor bugfixes (security):

    - Fix a potential double free bug when reading huge bandwidth files. The

      issue is not exploitable in the current Tor network because the

      vulnerable code is only reached when directory authorities read bandwidth

      files, but bandwidth files come from a trusted source (usually the

      authorities themselves). Furthermore, the issue is only exploitable in

      rare (non-POSIX) 32-bit architectures which are not used by any of the

      current authorities. Fixes bug 30040; bugfix on 0.3.5.1-alpha. Bug found

      and fixed by Tobias Stoeckmann.

src/ext/getdelim.c

+2 −1
Original line number Diff line number Diff line
@@ -67,7 +67,8 @@ compat_getdelim_(char **buf, size_t *bufsiz, int delimiter, FILE *fp) 
			char *nbuf;

			size_t nbufsiz = *bufsiz * 2;

			ssize_t d = ptr - *buf;

			if ((nbuf = raw_realloc(*buf, nbufsiz)) == NULL)

			if (nbufsiz < *bufsiz ||

			    (nbuf = raw_realloc(*buf, nbufsiz)) == NULL)

				return -1;

			*buf = nbuf;

			*bufsiz = nbufsiz;