'buf_read_from_tls()' can return the wrong error code
The function buf_read_from_tls(...) returns an integer. This integer can either be <=0 (in which case it corresponds to a TOR_TLS_ status) or a positive number (in which case it corresponds to the number of bytes read). This return value is used in connection_buf_read_from_socket() in a large switch(result) statement.
At the beginning of buf_read_from_tls(...), it returns -1 on the lines:
IF_BUG_ONCE(buf->datalen >= INT_MAX)
return -1;
IF_BUG_ONCE(buf->datalen >= INT_MAX - at_most)
return -1;This value of -1 is the same as TOR_TLS_WANTWRITE. This causes the switch statement in connection_buf_read_from_socket() to interpret the return value as TOR_TLS_WANTWRITE, which is not correct for the buf->datalen >= INT_MAX bug. I suggest returning TOR_TLS_ERROR_MISC instead of -1. Note that this would close the connection.
I don't think you'll see incorrect behavior due to this, but it might be a good idea to fix.