October 2013 - tor-commits - lists.torproject.org

[tor/master] Give credit to bug reporter for 9928
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit bfe56e05b08b940d432be9af824b969522eedc98 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 12:06:06 2013 -0400 Give credit to bug reporter for 9928 --- changes/bug9928 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/changes/bug9928 b/changes/bug9928 index e19bcf4..b72cea3 100644 --- a/changes/bug9928 +++ b/changes/bug9928 @@ -2,4 +2,5 @@ - Avoid an off-by-one error when checking buffer boundaries when formatting the exit status of a pluggable transport helper. This is probably not an exploitable bug, but better safe than - sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. + sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. Bug found by + Pedro Ribeiro.

1 0

[tor/master] Raise buffer size, fix checks for format_exit_helper_status.
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 17bcfb2604ba3c20a78cdcc78f169b4db6927d25 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 11:13:21 2013 -0400 Raise buffer size, fix checks for format_exit_helper_status. This is probably not an exploitable bug, since you would need to have errno be a large negative value in the unix pluggable-transport launcher case. Still, best avoided. Fixes bug 9928; bugfix on 0.2.3.18-rc. --- changes/bug9928 | 5 +++++ src/common/util.c | 10 +++++----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/changes/bug9928 b/changes/bug9928 new file mode 100644 index 0000000..e19bcf4 --- /dev/null +++ b/changes/bug9928 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Avoid an off-by-one error when checking buffer boundaries when + formatting the exit status of a pluggable transport helper. + This is probably not an exploitable bug, but better safe than + sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. diff --git a/src/common/util.c b/src/common/util.c index 6fb597a..5b0dbcd 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -3256,10 +3256,10 @@ format_hex_number_for_helper_exit_status(unsigned int x, char *buf, * hex_errno. Called between fork and _exit, so must be signal-handler * safe. * - * hex_errno must have at least HEX_ERRNO_SIZE bytes available. + * hex_errno must have at least HEX_ERRNO_SIZE+1 bytes available. * * The format of hex_errno is: "CHILD_STATE/ERRNO\n", left-padded - * with spaces. Note that there is no trailing \0. CHILD_STATE indicates where + * with spaces. CHILD_STATE indicates where * in the processs of starting the child process did the failure occur (see * CHILD_STATE_* macros for definition), and SAVED_ERRNO is the value of * errno when the failure occurred. @@ -3338,8 +3338,8 @@ format_helper_exit_status(unsigned char child_state, int saved_errno, left -= written; cur += written; - /* Check that we have enough space left for a newline */ - if (left <= 0) + /* Check that we have enough space left for a newline and a NUL */ + if (left <= 1) goto err; /* Emit the newline and NUL */ @@ -3594,7 +3594,7 @@ tor_spawn_background(const char *const filename, const char **argv, this is used for printing out the error message */ unsigned char child_state = CHILD_STATE_INIT; - char hex_errno[HEX_ERRNO_SIZE]; + char hex_errno[HEX_ERRNO_SIZE + 1]; static int max_fd = -1;

1 0

[tor/maint-0.2.4] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 1137817319c7a9e4293e9901405d01e7b85da6ea Merge: 73a0bb1 6eb7f2f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 10:55:24 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 changes/bug9928 | 6 ++++++ src/common/util.c | 10 +++++----- 2 files changed, 11 insertions(+), 5 deletions(-)

1 0

[tor/maint-0.2.4] Merge remote-tracking branch 'public/bug9928' into maint-0.2.3
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 6eb7f2f889d9e047ea75bad15531d4aff4dbc711 Merge: dece40f bfe56e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 10:53:27 2013 -0400 Merge remote-tracking branch 'public/bug9928' into maint-0.2.3 changes/bug9928 | 6 ++++++ src/common/util.c | 10 +++++----- 2 files changed, 11 insertions(+), 5 deletions(-)

1 0

[tor/maint-0.2.4] Raise buffer size, fix checks for format_exit_helper_status.
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 17bcfb2604ba3c20a78cdcc78f169b4db6927d25 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 11:13:21 2013 -0400 Raise buffer size, fix checks for format_exit_helper_status. This is probably not an exploitable bug, since you would need to have errno be a large negative value in the unix pluggable-transport launcher case. Still, best avoided. Fixes bug 9928; bugfix on 0.2.3.18-rc. --- changes/bug9928 | 5 +++++ src/common/util.c | 10 +++++----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/changes/bug9928 b/changes/bug9928 new file mode 100644 index 0000000..e19bcf4 --- /dev/null +++ b/changes/bug9928 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Avoid an off-by-one error when checking buffer boundaries when + formatting the exit status of a pluggable transport helper. + This is probably not an exploitable bug, but better safe than + sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. diff --git a/src/common/util.c b/src/common/util.c index 6fb597a..5b0dbcd 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -3256,10 +3256,10 @@ format_hex_number_for_helper_exit_status(unsigned int x, char *buf, * hex_errno. Called between fork and _exit, so must be signal-handler * safe. * - * hex_errno must have at least HEX_ERRNO_SIZE bytes available. + * hex_errno must have at least HEX_ERRNO_SIZE+1 bytes available. * * The format of hex_errno is: "CHILD_STATE/ERRNO\n", left-padded - * with spaces. Note that there is no trailing \0. CHILD_STATE indicates where + * with spaces. CHILD_STATE indicates where * in the processs of starting the child process did the failure occur (see * CHILD_STATE_* macros for definition), and SAVED_ERRNO is the value of * errno when the failure occurred. @@ -3338,8 +3338,8 @@ format_helper_exit_status(unsigned char child_state, int saved_errno, left -= written; cur += written; - /* Check that we have enough space left for a newline */ - if (left <= 0) + /* Check that we have enough space left for a newline and a NUL */ + if (left <= 1) goto err; /* Emit the newline and NUL */ @@ -3594,7 +3594,7 @@ tor_spawn_background(const char *const filename, const char **argv, this is used for printing out the error message */ unsigned char child_state = CHILD_STATE_INIT; - char hex_errno[HEX_ERRNO_SIZE]; + char hex_errno[HEX_ERRNO_SIZE + 1]; static int max_fd = -1;

1 0

[tor/maint-0.2.4] Give credit to bug reporter for 9928
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit bfe56e05b08b940d432be9af824b969522eedc98 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 12:06:06 2013 -0400 Give credit to bug reporter for 9928 --- changes/bug9928 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/changes/bug9928 b/changes/bug9928 index e19bcf4..b72cea3 100644 --- a/changes/bug9928 +++ b/changes/bug9928 @@ -2,4 +2,5 @@ - Avoid an off-by-one error when checking buffer boundaries when formatting the exit status of a pluggable transport helper. This is probably not an exploitable bug, but better safe than - sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. + sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. Bug found by + Pedro Ribeiro.

1 0

[tor/maint-0.2.3] Merge remote-tracking branch 'public/bug9928' into maint-0.2.3
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 6eb7f2f889d9e047ea75bad15531d4aff4dbc711 Merge: dece40f bfe56e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 10:53:27 2013 -0400 Merge remote-tracking branch 'public/bug9928' into maint-0.2.3 changes/bug9928 | 6 ++++++ src/common/util.c | 10 +++++----- 2 files changed, 11 insertions(+), 5 deletions(-)

1 0

[tor/maint-0.2.3] Give credit to bug reporter for 9928
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit bfe56e05b08b940d432be9af824b969522eedc98 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 12:06:06 2013 -0400 Give credit to bug reporter for 9928 --- changes/bug9928 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/changes/bug9928 b/changes/bug9928 index e19bcf4..b72cea3 100644 --- a/changes/bug9928 +++ b/changes/bug9928 @@ -2,4 +2,5 @@ - Avoid an off-by-one error when checking buffer boundaries when formatting the exit status of a pluggable transport helper. This is probably not an exploitable bug, but better safe than - sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. + sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. Bug found by + Pedro Ribeiro.

1 0

[tor/maint-0.2.3] Raise buffer size, fix checks for format_exit_helper_status.
by nickm＠torproject.org 10 Oct '13

10 Oct '13

commit 17bcfb2604ba3c20a78cdcc78f169b4db6927d25 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 11:13:21 2013 -0400 Raise buffer size, fix checks for format_exit_helper_status. This is probably not an exploitable bug, since you would need to have errno be a large negative value in the unix pluggable-transport launcher case. Still, best avoided. Fixes bug 9928; bugfix on 0.2.3.18-rc. --- changes/bug9928 | 5 +++++ src/common/util.c | 10 +++++----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/changes/bug9928 b/changes/bug9928 new file mode 100644 index 0000000..e19bcf4 --- /dev/null +++ b/changes/bug9928 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Avoid an off-by-one error when checking buffer boundaries when + formatting the exit status of a pluggable transport helper. + This is probably not an exploitable bug, but better safe than + sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. diff --git a/src/common/util.c b/src/common/util.c index 6fb597a..5b0dbcd 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -3256,10 +3256,10 @@ format_hex_number_for_helper_exit_status(unsigned int x, char *buf, * hex_errno. Called between fork and _exit, so must be signal-handler * safe. * - * hex_errno must have at least HEX_ERRNO_SIZE bytes available. + * hex_errno must have at least HEX_ERRNO_SIZE+1 bytes available. * * The format of hex_errno is: "CHILD_STATE/ERRNO\n", left-padded - * with spaces. Note that there is no trailing \0. CHILD_STATE indicates where + * with spaces. CHILD_STATE indicates where * in the processs of starting the child process did the failure occur (see * CHILD_STATE_* macros for definition), and SAVED_ERRNO is the value of * errno when the failure occurred. @@ -3338,8 +3338,8 @@ format_helper_exit_status(unsigned char child_state, int saved_errno, left -= written; cur += written; - /* Check that we have enough space left for a newline */ - if (left <= 0) + /* Check that we have enough space left for a newline and a NUL */ + if (left <= 1) goto err; /* Emit the newline and NUL */ @@ -3594,7 +3594,7 @@ tor_spawn_background(const char *const filename, const char **argv, this is used for printing out the error message */ unsigned char child_state = CHILD_STATE_INIT; - char hex_errno[HEX_ERRNO_SIZE]; + char hex_errno[HEX_ERRNO_SIZE + 1]; static int max_fd = -1;

1 0

[translation/gettor] Update translations for gettor
by translation＠torproject.org 10 Oct '13

10 Oct '13

commit 7f7ef1ae0e099d61f8cc52b6902fac222e115cee Author: Translation commit bot <translation(a)torproject.org> Date: Thu Oct 10 14:45:05 2013 +0000 Update translations for gettor --- ms_MY/gettor.po | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/ms_MY/gettor.po b/ms_MY/gettor.po index 7386138..b65e77c 100644 --- a/ms_MY/gettor.po +++ b/ms_MY/gettor.po @@ -9,7 +9,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2013-01-19 13:40+0100\n" -"PO-Revision-Date: 2013-10-10 14:14+0000\n" +"PO-Revision-Date: 2013-10-10 14:30+0000\n" "Last-Translator: shahril <mohd_shahril_96(a)yahoo.com>\n" "Language-Team: Malay (Malaysia) (http://www.transifex.com/projects/p/torproject/language/ms_MY/)\n" "MIME-Version: 1.0\n" @@ -96,7 +96,7 @@ msgid "" "This example will give you the requested package in a localized\n" "version for Farsi (Persian). Check below for a list of supported language\n" "codes. " -msgstr "" +msgstr "Contoh ini akan memberikan anda pakej yang diminta dalam versi bahasa\nuntuk Parsi (Persian). Semak di bawah untuk senarai kod bahasa yang\ndisokong." #: lib/gettor/i18n.py:76 msgid " List of supported locales:" @@ -129,14 +129,14 @@ msgstr "Jika anda tidak memilih sebarang bahasa yang ada, anda akan menerima ver msgid "" "SMALLER SIZED PACKAGES\n" "======================" -msgstr "" +msgstr "PAKEJ SAIZ KECIL\n==============" #: lib/gettor/i18n.py:97 msgid "" "If your bandwith is low or your provider doesn't allow you to\n" "receive large attachments in your email, GetTor can send you several\n" "small packages instead of one big one." -msgstr "" +msgstr "Jika bandwidth anda rendah dan pembekal anda tidak membenarkan\nanda untuk menerima attachment bersaiz besar di dalam email anda,\nGetTor boleh menghantar anda pakej yang bersaiz kecil yang telah \ndipecahkan selain dari pakej bersaiz besar." #: lib/gettor/i18n.py:101 msgid "" @@ -145,7 +145,7 @@ msgid "" " \n" " windows\n" " split" -msgstr "" +msgstr "Hanya masukkan ayat 'split' pada line baru seperti yang berikut (part ini penting) :-\n\nwindows\nsplit" #: lib/gettor/i18n.py:107 msgid "" @@ -168,7 +168,7 @@ msgid "" "2.) Unzip all files ending in \".z\". If you saved all attachments to\n" "a fresh folder before, simply unzip all files in that folder. If you don't\n" "know how to unzip the .z files, please see the UNPACKING THE FILES section." -msgstr "" +msgstr "2.) Unzil semua fail yang berakhir dengan \".z\". Jika kamu simpan semua fail\ndi dalam folder baru sebelum itu, unzip semua file di dalam folder itu. Jika kamu\ntidak tahu apakah itu unzip fail .z, sila lihat bahagian seksyen NYAHMAMPAT FAIL." #: lib/gettor/i18n.py:119 msgid "" @@ -181,7 +181,7 @@ msgid "" "4.) Now unpack the multi-volume archive into one file by double-\n" "clicking the file ending in \"..split.part01.exe\". This should start the \n" "process automatically." -msgstr "" +msgstr "4.) Sekarang nyah mampat arkib pecahan itu kepada fail tunggal dengan\nmeng-klik fail yang namanya berakhir dengan \"..split.part01.exe\". Process\nini akan bermula secara automatik." #: lib/gettor/i18n.py:126 msgid "" @@ -198,7 +198,7 @@ msgstr "6.) Selesai. Terima kasih kerana menggunakan Tor dan selamat bergembira! msgid "" "SUPPORT\n" "=======" -msgstr "" +msgstr "BANTUAN\n========" #: lib/gettor/i18n.py:138 msgid ""

1 0