June 2011 - tor-commits - lists.torproject.org

[tor/master] Fix crash bug (3361) when setting off-flavor networkstatus
by nickm＠torproject.org 07 Jun '11

07 Jun '11

commit d696bd1bfc3b61943ae4a2be8e4a9fcdfeaec246 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jun 7 14:46:28 2011 -0400 Fix crash bug (3361) when setting off-flavor networkstatus When we set a networkstatus in the non-preferred flavor, we'd check the time in the current_consensus. But that might have been NULL, which could produce a crash as seen in bug 3361. --- changes/bug3361 | 4 ++++ src/or/networkstatus.c | 2 +- 2 files changed, 5 insertions(+), 1 deletions(-) diff --git a/changes/bug3361 b/changes/bug3361 new file mode 100644 index 0000000..06bd954 --- /dev/null +++ b/changes/bug3361 @@ -0,0 +1,4 @@ + o Major bugfixes: + - Fix a crash bug that could occur when setting a consensus in a + non-used flavor without having a current consensus set. Fixes bug + 3361; bugfix on 0.2.3.1-alpha. diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c index 837c8c2..ab1358b 100644 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@ -1814,7 +1814,7 @@ networkstatus_set_current_consensus(const char *consensus, * valid-after time, declare that our clock is skewed. */ #define EARLY_CONSENSUS_NOTICE_SKEW 60 - if (now < current_consensus->valid_after - EARLY_CONSENSUS_NOTICE_SKEW) { + if (now < c->valid_after - EARLY_CONSENSUS_NOTICE_SKEW) { char tbuf[ISO_TIME_LEN+1]; char dbuf[64]; long delta = now - c->valid_after;

1 0

r24811: {website} fix up some of the call to action buttons, add an ie8 and lo (website/trunk/css)
by Andrew Lewman 07 Jun '11

07 Jun '11

Author: phobos Date: 2011-06-07 02:29:16 +0000 (Tue, 07 Jun 2011) New Revision: 24811 Added: website/trunk/css/ie8-and-down.css Modified: website/trunk/css/layout.css Log: fix up some of the call to action buttons, add an ie8 and lower css file. Added: website/trunk/css/ie8-and-down.css =================================================================== --- website/trunk/css/ie8-and-down.css (rev 0) +++ website/trunk/css/ie8-and-down.css 2011-06-07 02:29:16 UTC (rev 24811) @@ -0,0 +1,12 @@ +@charset "UTF-8"; +/* IE8 and down */ + + +#calltoaction ul li:first-child a:link, +#calltoaction ul li:first-child a:visited { + background: url(../images/cta-buttons.jpg) top center no-repeat; + } + +#calltoaction ul li:hover:first-child a { + background: url(../images/cta-buttons.jpg) bottom center no-repeat #ff9800; + } Property changes on: website/trunk/css/ie8-and-down.css ___________________________________________________________________ Added: svn:mime-type + text/css Modified: website/trunk/css/layout.css =================================================================== --- website/trunk/css/layout.css 2011-06-06 03:47:46 UTC (rev 24810) +++ website/trunk/css/layout.css 2011-06-07 02:29:16 UTC (rev 24811) @@ -93,7 +93,7 @@ #calltoaction ul li a:link, #calltoaction ul li a:visited { - background: url(../images/cta-buttons.jpg) top center no-repeat; + background: url(../images/cta-buttons.jpg) top center no-repeat #885ca4; padding: 8px 8px 0px; color: #FFFFFF; font-weight: bold; @@ -108,8 +108,8 @@ #calltoaction ul li:first-child a:link, #calltoaction ul li:first-child a:visited { - background: url(../images/cta-buttons.jpg) top left no-repeat; - -webkit-border-top-left-radius: 7px; + background: url(../images/cta-buttons.jpg) top left no-repeat #885ca4; + -webkit-border-top-left-radius: 7px; -webkit-border-bottom-left-radius: 7px; -moz-border-radius-topleft: 7px; -moz-border-radius-bottomleft: 7px; @@ -121,7 +121,7 @@ #calltoaction ul li:last-child a:link, #calltoaction ul li:last-child a:visited { - background: url(../images/cta-buttons.jpg) top right no-repeat; + background: url(../images/cta-buttons.jpg) top right no-repeat #885ca4; -webkit-border-top-right-radius: 7px; -webkit-border-bottom-right-radius: 7px; -moz-border-radius-topright: 7px;

1 0

[tor/master] Merge remote-tracking branch 'asn2/bug3336'
by nickm＠torproject.org 06 Jun '11

06 Jun '11

commit d25d08dc4dceef484206c932648023b36cf3ec7c Merge: 8cd5a3c 9eab601 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 6 18:34:45 2011 -0400 Merge remote-tracking branch 'asn2/bug3336' src/common/log.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

1 0

[tor/master] Add the heartbeat domain in log.c:domain_list[]
by nickm＠torproject.org 06 Jun '11

06 Jun '11

commit 9eab601f10958ad75b3aef0015f32fc339609054 Author: George Kadianakis <desnacked(a)gmail.com> Date: Sun Jun 5 21:27:53 2011 +0200 Add the heartbeat domain in log.c:domain_list[] so that parse_log_domain() doesn't fail. --- src/common/log.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/common/log.c b/src/common/log.c index abdce14..9740062 100644 --- a/src/common/log.c +++ b/src/common/log.c @@ -899,7 +899,7 @@ log_level_to_string(int level) static const char *domain_list[] = { "GENERAL", "CRYPTO", "NET", "CONFIG", "FS", "PROTOCOL", "MM", "HTTP", "APP", "CONTROL", "CIRC", "REND", "BUG", "DIR", "DIRSERV", - "OR", "EDGE", "ACCT", "HIST", "HANDSHAKE", NULL + "OR", "EDGE", "ACCT", "HIST", "HANDSHAKE", "HEARTBEAT", NULL }; /** Return a bitmask for the log domain for which domain is the name,

1 0

[tor/master] Merge branch 'bug3306_nm_squashed' into maint-0.2.2
by nickm＠torproject.org 06 Jun '11

06 Jun '11

commit 9e3fc5f61685f937d76e60c5fa1781b80aa5bf68 Merge: 83e3975 42e4e15 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 6 16:18:24 2011 -0400 Merge branch 'bug3306_nm_squashed' into maint-0.2.2 changes/bug3306 | 9 +++++++++ src/common/crypto.c | 5 +++-- src/or/circuitbuild.c | 10 +++++++++- 3 files changed, 21 insertions(+), 3 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 06 Jun '11

06 Jun '11

commit 8cd5a3c1865c2115d88b08041a27e2cfdd7d24d2 Merge: 96da10a 9e3fc5f Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 6 16:20:22 2011 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' changes/bug3306 | 9 +++++++++ src/common/crypto.c | 5 +++-- src/or/circuitbuild.c | 10 +++++++++- 3 files changed, 21 insertions(+), 3 deletions(-)

1 0

[tor/master] Check maximum properly in crypto_rand_int()
by nickm＠torproject.org 06 Jun '11

06 Jun '11

commit 5afab5ca197112b01135980d6cb3694a4519e3cf Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 1 11:48:39 2011 -0400 Check maximum properly in crypto_rand_int() George Kadianakis notes that if you give crypto_rand_int() a value above INT_MAX, it can return a negative number, which is not what the documentation would imply. The simple solution is to assert that the input is in [1,INT_MAX+1]. If in the future we need a random-value function that can return values up to UINT_MAX, we can add one. Fixes bug 3306; bugfix on 0.2.2pre14. --- changes/bug3306 | 5 +++++ src/common/crypto.c | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/changes/bug3306 b/changes/bug3306 new file mode 100644 index 0000000..b1bb103 --- /dev/null +++ b/changes/bug3306 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Make our crypto_rand_int() function check the value of its input + correctly. Previously, it accepted values up to UINT_MAX, but + could return a negative number if given a value above INT_MAX+1. + Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14. diff --git a/src/common/crypto.c b/src/common/crypto.c index d8e6619..851f11b 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -2145,13 +2145,14 @@ crypto_rand(char *to, size_t n) } /** Return a pseudorandom integer, chosen uniformly from the values - * between 0 and max-1. */ + * between 0 and max-1 inclusive. max must be between 1 and + * INT_MAX+1, inclusive. */ int crypto_rand_int(unsigned int max) { unsigned int val; unsigned int cutoff; - tor_assert(max < UINT_MAX); + tor_assert(max <= ((unsigned int)INT_MAX)+1); tor_assert(max > 0); /* don't div by 0 */ /* We ignore any values that are >= 'cutoff,' to avoid biasing the

1 0

[tor/master] Detect insanely large circuit build state; don't give its length to rand_int
by nickm＠torproject.org 06 Jun '11

06 Jun '11

commit 42e4e156d95a1c28a666a5346d491c4ed71435dd Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 1 12:12:01 2011 -0400 Detect insanely large circuit build state; don't give its length to rand_int --- changes/bug3306 | 4 ++++ src/or/circuitbuild.c | 10 +++++++++- 2 files changed, 13 insertions(+), 1 deletions(-) diff --git a/changes/bug3306 b/changes/bug3306 index b1bb103..f868a24 100644 --- a/changes/bug3306 +++ b/changes/bug3306 @@ -3,3 +3,7 @@ correctly. Previously, it accepted values up to UINT_MAX, but could return a negative number if given a value above INT_MAX+1. Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14. + + - Avoid a segfault when reading a malformed circuit build state + with more than INT_MAX entries. Found by wanoskarnet. Bugfix on + 0.2.2.4-alpha. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 3f08448..6d7e711 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -678,7 +678,15 @@ circuit_build_times_shuffle_and_store_array(circuit_build_times_t *cbt, log_notice(LD_CIRC, "The number of circuit times that this Tor version " "uses to calculate build times is less than the number stored " "in your state file. Decreasing the circuit time history from " - "%d to %d.", num_times, CBT_NCIRCUITS_TO_OBSERVE); + "%lu to %d.", (unsigned long)num_times, + CBT_NCIRCUITS_TO_OBSERVE); + } + + if (n > INT_MAX-1) { + log_warn(LD_CIRC, "For some insane reasons, you had %lu circuit build " + "observations in your state file. That's far too many; probably " + "there's a bug here.", (unsigned long)n); + n = INT_MAX-1; } /* This code can only be run on a compact array */

1 0

[tor/maint-0.2.2] Detect insanely large circuit build state; don't give its length to rand_int
by nickm＠torproject.org 06 Jun '11

06 Jun '11

commit 42e4e156d95a1c28a666a5346d491c4ed71435dd Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 1 12:12:01 2011 -0400 Detect insanely large circuit build state; don't give its length to rand_int --- changes/bug3306 | 4 ++++ src/or/circuitbuild.c | 10 +++++++++- 2 files changed, 13 insertions(+), 1 deletions(-) diff --git a/changes/bug3306 b/changes/bug3306 index b1bb103..f868a24 100644 --- a/changes/bug3306 +++ b/changes/bug3306 @@ -3,3 +3,7 @@ correctly. Previously, it accepted values up to UINT_MAX, but could return a negative number if given a value above INT_MAX+1. Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14. + + - Avoid a segfault when reading a malformed circuit build state + with more than INT_MAX entries. Found by wanoskarnet. Bugfix on + 0.2.2.4-alpha. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 3f08448..6d7e711 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -678,7 +678,15 @@ circuit_build_times_shuffle_and_store_array(circuit_build_times_t *cbt, log_notice(LD_CIRC, "The number of circuit times that this Tor version " "uses to calculate build times is less than the number stored " "in your state file. Decreasing the circuit time history from " - "%d to %d.", num_times, CBT_NCIRCUITS_TO_OBSERVE); + "%lu to %d.", (unsigned long)num_times, + CBT_NCIRCUITS_TO_OBSERVE); + } + + if (n > INT_MAX-1) { + log_warn(LD_CIRC, "For some insane reasons, you had %lu circuit build " + "observations in your state file. That's far too many; probably " + "there's a bug here.", (unsigned long)n); + n = INT_MAX-1; } /* This code can only be run on a compact array */

1 0

[tor/maint-0.2.2] Merge branch 'bug3306_nm_squashed' into maint-0.2.2
by nickm＠torproject.org 06 Jun '11

06 Jun '11

commit 9e3fc5f61685f937d76e60c5fa1781b80aa5bf68 Merge: 83e3975 42e4e15 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 6 16:18:24 2011 -0400 Merge branch 'bug3306_nm_squashed' into maint-0.2.2 changes/bug3306 | 9 +++++++++ src/common/crypto.c | 5 +++-- src/or/circuitbuild.c | 10 +++++++++- 3 files changed, 21 insertions(+), 3 deletions(-)

1 0