tor-commits October 2013

tor-commits@lists.torproject.org

17 participants
1284 discussions

[tor/master] Fix unit test for format_helper_exit_status
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 004a9c6dd11ba71f310b750f00d5ed403faceb5a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 11:15:35 2013 -0400 Fix unit test for format_helper_exit_status Fix format_helper_exit_status to allow full HEX_ERRNO_SIZE answers, *and* increase the buffer length again. --- src/common/util.c | 4 ++-- src/test/test_util.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/common/util.c b/src/common/util.c index 5b0dbcd..b16afa1 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -3294,7 +3294,7 @@ format_helper_exit_status(unsigned char child_state, int saved_errno, * Count how many chars of space we have left, and keep a pointer into the * current point in the buffer. */ - left = HEX_ERRNO_SIZE; + left = HEX_ERRNO_SIZE+1; cur = hex_errno; /* Emit child_state */ @@ -3594,7 +3594,7 @@ tor_spawn_background(const char *const filename, const char **argv, this is used for printing out the error message */ unsigned char child_state = CHILD_STATE_INIT; - char hex_errno[HEX_ERRNO_SIZE + 1]; + char hex_errno[HEX_ERRNO_SIZE + 2]; /* + 1 should be sufficient actually */ static int max_fd = -1; diff --git a/src/test/test_util.c b/src/test/test_util.c index 4f9eb73..6c72247 100644 --- a/src/test/test_util.c +++ b/src/test/test_util.c @@ -2169,6 +2169,7 @@ test_util_exit_status(void *ptr) n = format_helper_exit_status(0xFF, -0x80000000, hex_errno); test_streq("FF/-80000000\n", hex_errno); test_eq(n, strlen(hex_errno)); + test_eq(n, HEX_ERRNO_SIZE); clear_hex_errno(hex_errno); n = format_helper_exit_status(0x7F, 0, hex_errno);

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 7b1b8c36942a09ff4c50ac228f465aa4050153e3 Merge: 1137817 004a9c6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 11:18:07 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 src/common/util.c | 4 ++-- src/test/test_util.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4'
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 3d817fa29cb9a0f58dd641aabf7f34301bf5809d Merge: 97285bc 7b1b8c3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 11:18:17 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' src/common/util.c | 4 ++-- src/test/test_util.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.2.4] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 10 Oct '13

10 Oct '13

1 0

[tor/maint-0.2.4] Fix unit test for format_helper_exit_status
by nickm＠torproject.org 10 Oct '13

10 Oct '13

1 0

[tor/maint-0.2.3] Fix unit test for format_helper_exit_status
by nickm＠torproject.org 10 Oct '13

10 Oct '13

1 0

[tor/master] Raise buffer size, fix checks for format_exit_helper_status.
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 17bcfb2604ba3c20a78cdcc78f169b4db6927d25 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 11:13:21 2013 -0400 Raise buffer size, fix checks for format_exit_helper_status. This is probably not an exploitable bug, since you would need to have errno be a large negative value in the unix pluggable-transport launcher case. Still, best avoided. Fixes bug 9928; bugfix on 0.2.3.18-rc. --- changes/bug9928 | 5 +++++ src/common/util.c | 10 +++++----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/changes/bug9928 b/changes/bug9928 new file mode 100644 index 0000000..e19bcf4 --- /dev/null +++ b/changes/bug9928 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Avoid an off-by-one error when checking buffer boundaries when + formatting the exit status of a pluggable transport helper. + This is probably not an exploitable bug, but better safe than + sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. diff --git a/src/common/util.c b/src/common/util.c index 6fb597a..5b0dbcd 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -3256,10 +3256,10 @@ format_hex_number_for_helper_exit_status(unsigned int x, char *buf, * hex_errno. Called between fork and _exit, so must be signal-handler * safe. * - * hex_errno must have at least HEX_ERRNO_SIZE bytes available. + * hex_errno must have at least HEX_ERRNO_SIZE+1 bytes available. * * The format of hex_errno is: "CHILD_STATE/ERRNO\n", left-padded - * with spaces. Note that there is no trailing \0. CHILD_STATE indicates where + * with spaces. CHILD_STATE indicates where * in the processs of starting the child process did the failure occur (see * CHILD_STATE_* macros for definition), and SAVED_ERRNO is the value of * errno when the failure occurred. @@ -3338,8 +3338,8 @@ format_helper_exit_status(unsigned char child_state, int saved_errno, left -= written; cur += written; - /* Check that we have enough space left for a newline */ - if (left <= 0) + /* Check that we have enough space left for a newline and a NUL */ + if (left <= 1) goto err; /* Emit the newline and NUL */ @@ -3594,7 +3594,7 @@ tor_spawn_background(const char *const filename, const char **argv, this is used for printing out the error message */ unsigned char child_state = CHILD_STATE_INIT; - char hex_errno[HEX_ERRNO_SIZE]; + char hex_errno[HEX_ERRNO_SIZE + 1]; static int max_fd = -1;

1 0

[tor/master] Give credit to bug reporter for 9928
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit bfe56e05b08b940d432be9af824b969522eedc98 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 12:06:06 2013 -0400 Give credit to bug reporter for 9928 --- changes/bug9928 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/changes/bug9928 b/changes/bug9928 index e19bcf4..b72cea3 100644 --- a/changes/bug9928 +++ b/changes/bug9928 @@ -2,4 +2,5 @@ - Avoid an off-by-one error when checking buffer boundaries when formatting the exit status of a pluggable transport helper. This is probably not an exploitable bug, but better safe than - sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. + sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. Bug found by + Pedro Ribeiro.

1 0

[tor/master] Merge remote-tracking branch 'public/bug9928' into maint-0.2.3
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 6eb7f2f889d9e047ea75bad15531d4aff4dbc711 Merge: dece40f bfe56e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 10:53:27 2013 -0400 Merge remote-tracking branch 'public/bug9928' into maint-0.2.3 changes/bug9928 | 6 ++++++ src/common/util.c | 10 +++++----- 2 files changed, 11 insertions(+), 5 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 1137817319c7a9e4293e9901405d01e7b85da6ea Merge: 73a0bb1 6eb7f2f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 10:55:24 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 changes/bug9928 | 6 ++++++ src/common/util.c | 10 +++++----- 2 files changed, 11 insertions(+), 5 deletions(-)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits October 2013