October 2013 - tor-commits - lists.torproject.org

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4'
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 3d817fa29cb9a0f58dd641aabf7f34301bf5809d Merge: 97285bc 7b1b8c3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 11:18:17 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' src/common/util.c | 4 ++-- src/test/test_util.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 7b1b8c36942a09ff4c50ac228f465aa4050153e3 Merge: 1137817 004a9c6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 11:18:07 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 src/common/util.c | 4 ++-- src/test/test_util.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-)

1 0

[tor/master] Fix unit test for format_helper_exit_status
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 004a9c6dd11ba71f310b750f00d5ed403faceb5a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 11:15:35 2013 -0400 Fix unit test for format_helper_exit_status Fix format_helper_exit_status to allow full HEX_ERRNO_SIZE answers, *and* increase the buffer length again. --- src/common/util.c | 4 ++-- src/test/test_util.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/common/util.c b/src/common/util.c index 5b0dbcd..b16afa1 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -3294,7 +3294,7 @@ format_helper_exit_status(unsigned char child_state, int saved_errno, * Count how many chars of space we have left, and keep a pointer into the * current point in the buffer. */ - left = HEX_ERRNO_SIZE; + left = HEX_ERRNO_SIZE+1; cur = hex_errno; /* Emit child_state */ @@ -3594,7 +3594,7 @@ tor_spawn_background(const char *const filename, const char **argv, this is used for printing out the error message */ unsigned char child_state = CHILD_STATE_INIT; - char hex_errno[HEX_ERRNO_SIZE + 1]; + char hex_errno[HEX_ERRNO_SIZE + 2]; /* + 1 should be sufficient actually */ static int max_fd = -1; diff --git a/src/test/test_util.c b/src/test/test_util.c index 4f9eb73..6c72247 100644 --- a/src/test/test_util.c +++ b/src/test/test_util.c @@ -2169,6 +2169,7 @@ test_util_exit_status(void *ptr) n = format_helper_exit_status(0xFF, -0x80000000, hex_errno); test_streq("FF/-80000000\n", hex_errno); test_eq(n, strlen(hex_errno)); + test_eq(n, HEX_ERRNO_SIZE); clear_hex_errno(hex_errno); n = format_helper_exit_status(0x7F, 0, hex_errno);

1 0

[tor/maint-0.2.4] Fix unit test for format_helper_exit_status
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 004a9c6dd11ba71f310b750f00d5ed403faceb5a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 11:15:35 2013 -0400 Fix unit test for format_helper_exit_status Fix format_helper_exit_status to allow full HEX_ERRNO_SIZE answers, *and* increase the buffer length again. --- src/common/util.c | 4 ++-- src/test/test_util.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/common/util.c b/src/common/util.c index 5b0dbcd..b16afa1 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -3294,7 +3294,7 @@ format_helper_exit_status(unsigned char child_state, int saved_errno, * Count how many chars of space we have left, and keep a pointer into the * current point in the buffer. */ - left = HEX_ERRNO_SIZE; + left = HEX_ERRNO_SIZE+1; cur = hex_errno; /* Emit child_state */ @@ -3594,7 +3594,7 @@ tor_spawn_background(const char *const filename, const char **argv, this is used for printing out the error message */ unsigned char child_state = CHILD_STATE_INIT; - char hex_errno[HEX_ERRNO_SIZE + 1]; + char hex_errno[HEX_ERRNO_SIZE + 2]; /* + 1 should be sufficient actually */ static int max_fd = -1; diff --git a/src/test/test_util.c b/src/test/test_util.c index 4f9eb73..6c72247 100644 --- a/src/test/test_util.c +++ b/src/test/test_util.c @@ -2169,6 +2169,7 @@ test_util_exit_status(void *ptr) n = format_helper_exit_status(0xFF, -0x80000000, hex_errno); test_streq("FF/-80000000\n", hex_errno); test_eq(n, strlen(hex_errno)); + test_eq(n, HEX_ERRNO_SIZE); clear_hex_errno(hex_errno); n = format_helper_exit_status(0x7F, 0, hex_errno);

1 0

[tor/maint-0.2.4] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 7b1b8c36942a09ff4c50ac228f465aa4050153e3 Merge: 1137817 004a9c6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 11:18:07 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 src/common/util.c | 4 ++-- src/test/test_util.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.2.3] Fix unit test for format_helper_exit_status
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 004a9c6dd11ba71f310b750f00d5ed403faceb5a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 11:15:35 2013 -0400 Fix unit test for format_helper_exit_status Fix format_helper_exit_status to allow full HEX_ERRNO_SIZE answers, *and* increase the buffer length again. --- src/common/util.c | 4 ++-- src/test/test_util.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/common/util.c b/src/common/util.c index 5b0dbcd..b16afa1 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -3294,7 +3294,7 @@ format_helper_exit_status(unsigned char child_state, int saved_errno, * Count how many chars of space we have left, and keep a pointer into the * current point in the buffer. */ - left = HEX_ERRNO_SIZE; + left = HEX_ERRNO_SIZE+1; cur = hex_errno; /* Emit child_state */ @@ -3594,7 +3594,7 @@ tor_spawn_background(const char *const filename, const char **argv, this is used for printing out the error message */ unsigned char child_state = CHILD_STATE_INIT; - char hex_errno[HEX_ERRNO_SIZE + 1]; + char hex_errno[HEX_ERRNO_SIZE + 2]; /* + 1 should be sufficient actually */ static int max_fd = -1; diff --git a/src/test/test_util.c b/src/test/test_util.c index 4f9eb73..6c72247 100644 --- a/src/test/test_util.c +++ b/src/test/test_util.c @@ -2169,6 +2169,7 @@ test_util_exit_status(void *ptr) n = format_helper_exit_status(0xFF, -0x80000000, hex_errno); test_streq("FF/-80000000\n", hex_errno); test_eq(n, strlen(hex_errno)); + test_eq(n, HEX_ERRNO_SIZE); clear_hex_errno(hex_errno); n = format_helper_exit_status(0x7F, 0, hex_errno);

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4'
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 97285bc46550ba135a2567d89351159da8db99f8 Merge: 3b6c483 1137817 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 10:55:58 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' changes/bug9928 | 6 ++++++ src/common/util.c | 10 +++++----- 2 files changed, 11 insertions(+), 5 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 1137817319c7a9e4293e9901405d01e7b85da6ea Merge: 73a0bb1 6eb7f2f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 10:55:24 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 changes/bug9928 | 6 ++++++ src/common/util.c | 10 +++++----- 2 files changed, 11 insertions(+), 5 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'public/bug9928' into maint-0.2.3
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 6eb7f2f889d9e047ea75bad15531d4aff4dbc711 Merge: dece40f bfe56e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 10:53:27 2013 -0400 Merge remote-tracking branch 'public/bug9928' into maint-0.2.3 changes/bug9928 | 6 ++++++ src/common/util.c | 10 +++++----- 2 files changed, 11 insertions(+), 5 deletions(-)

1 0

[tor/master] Give credit to bug reporter for 9928
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit bfe56e05b08b940d432be9af824b969522eedc98 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 12:06:06 2013 -0400 Give credit to bug reporter for 9928 --- changes/bug9928 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/changes/bug9928 b/changes/bug9928 index e19bcf4..b72cea3 100644 --- a/changes/bug9928 +++ b/changes/bug9928 @@ -2,4 +2,5 @@ - Avoid an off-by-one error when checking buffer boundaries when formatting the exit status of a pluggable transport helper. This is probably not an exploitable bug, but better safe than - sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. + sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. Bug found by + Pedro Ribeiro.

1 0