Skip to content

GitLab

T
Tor

GitLab is used only for code review, issue tracking and project management. Canonical locations for source code are still https://gitweb.torproject.org/ https://git.torproject.org/ and git-rw.torproject.org.

Switch branch/tag
  1. 22 Sep, 2020 1 commit
  3. 21 Sep, 2020 5 commits
  5. 18 Sep, 2020 3 commits
  7. 17 Sep, 2020 2 commits
  9. 13 Aug, 2020 3 commits
  11. 12 Aug, 2020 5 commits
  13. 11 Aug, 2020 5 commits
  15. 10 Aug, 2020 3 commits
  17. 06 Aug, 2020 1 commit
  19. 30 Jul, 2020 2 commits
  21. 28 Jul, 2020 1 commit
  23. 24 Jul, 2020 1 commit
  25. 23 Jul, 2020 2 commits
  27. 09 Jul, 2020 3 commits
  29. 07 Jul, 2020 2 commits
  31. 06 Jul, 2020 1 commit
    • Alexander Færøy's avatar
      Use ((x + 7) >> 3) instead of (x >> 3) when converting from bits to bytes. · 7b2d1070
      Alexander Færøy authored 
      This patch changes our bits-to-bytes conversion logic in the NSS
implementation of `tor_tls_cert_matches_key()` from using (x >> 3) to
((x + 7) >> 3) since DER bit-strings are allowed to contain a number of
bits that is not a multiple of 8.

Additionally, we add a comment on why we cannot use the
`DER_ConvertBitString()` macro from NSS, as we would potentially apply
the bits-to-bytes conversion logic twice, which would lead to an
insignificant amount of bytes being compared in
`SECITEM_ItemsAreEqual()` and thus turn the logic into being a
prefix match instead of a full match.

The `DER_ConvertBitString()` macro is defined in NSS as:

    /*
    ** Macro to convert der decoded bit string into a decoded octet
    ** string. All it needs to do is fiddle with the length code.
    */
    #define DER_ConvertBitString(item)            \
        {                                         \
            (item)->len = ((item)->len + 7) >> 3; \
        }

Thanks to Taylor Yu for spotting this problem.

This patch is part of the fix for TROVE-2020-001.

See: https://bugs.torproject.org/33119
      7b2d1070