March 2015 - tor-commits - lists.torproject.org

[tor/maint-0.2.6] Merge remote-tracking branch 'origin/maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit a7f75b2056b8bdf59d064268c53a10ac46972380 Merge: de2c5ad 1a7419c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 9 11:09:49 2015 -0400 Merge remote-tracking branch 'origin/maint-0.2.5' into maint-0.2.6 changes/bug15083 | 10 ++++++++++ src/or/buffers.c | 11 +++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.2.5] Do not leave empty, invalid chunks in buffers during buf_pullup
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit 71ee53fe9bdf3f64eef9b38de55960185e8be1b5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 3 22:20:17 2015 +0100 Do not leave empty, invalid chunks in buffers during buf_pullup This fixes an assertion failure bug in 15083; bugfix on 0.2.0.10-alpha. Patch from 'cypherpunks' --- changes/bug15083 | 6 ++++++ src/or/buffers.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/bug15083 b/changes/bug15083 new file mode 100644 index 0000000..98d1d0e --- /dev/null +++ b/changes/bug15083 @@ -0,0 +1,6 @@ + o Major bugfixes (relay, stability): + - Fix a bug that could lead to a relay crashing with an assertion + failure if a buffer of exactly the wrong layout was passed + to buf_pullup() at exactly the wrong time. Fixes bug 15083; + bugfix on 0.2.0.10-alpha. Patch from 'cypherpunks'. + diff --git a/src/or/buffers.c b/src/or/buffers.c index 9be0476..7976432 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -426,7 +426,7 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate) size_t n = bytes - dest->datalen; src = dest->next; tor_assert(src); - if (n > src->datalen) { + if (n >= src->datalen) { memcpy(CHUNK_WRITE_PTR(dest), src->data, src->datalen); dest->datalen += src->datalen; dest->next = src->next;

1 0

[tor/maint-0.2.5] Make the assert related to 15083 a tiny bit more tolerant
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit 81a994ce77038721df3aa2f77b783db9a52da79e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 3 22:25:26 2015 +0100 Make the assert related to 15083 a tiny bit more tolerant --- changes/bug15083 | 6 +++++- src/or/buffers.c | 9 ++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/changes/bug15083 b/changes/bug15083 index 98d1d0e..2bd0715 100644 --- a/changes/bug15083 +++ b/changes/bug15083 @@ -3,4 +3,8 @@ failure if a buffer of exactly the wrong layout was passed to buf_pullup() at exactly the wrong time. Fixes bug 15083; bugfix on 0.2.0.10-alpha. Patch from 'cypherpunks'. - + + - Do not assert if the 'data' pointer on a buffer is advanced to the very + end of the buffer; log a BUG message instead. Only assert if it is + past that point. Fixes bug 15083; bugfix on 0.2.0.10-alpha. + diff --git a/src/or/buffers.c b/src/or/buffers.c index 7976432..9dfed00 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -2483,7 +2483,14 @@ assert_buf_ok(buf_t *buf) total += ch->datalen; tor_assert(ch->datalen <= ch->memlen); tor_assert(ch->data >= &ch->mem[0]); - tor_assert(ch->data < &ch->mem[0]+ch->memlen); + tor_assert(ch->data <= &ch->mem[0]+ch->memlen); + if (ch->data == &ch->mem[0]+ch->memlen) { + static int warned = 0; + if (! warned) { + log_warn(LD_BUG, "Invariant violation in buf.c related to #15083"); + warned = 1; + } + } tor_assert(ch->data+ch->datalen <= &ch->mem[0] + ch->memlen); if (!ch->next) tor_assert(ch == buf->tail);

1 0

[tor/maint-0.2.5] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit 6704e18dd2e09111eeca0c76fb00a459f9da98ea Merge: 2bcb596 addffcc Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 9 11:08:57 2015 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 changes/bug15083 | 10 ++++++++++ src/or/buffers.c | 11 +++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.2.5] Adjust changes header
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit addffcc14ddf40b3cd1bff3fa86a82354e981a03 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 9 11:07:50 2015 -0400 Adjust changes header --- changes/bug15083 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changes/bug15083 b/changes/bug15083 index 2bd0715..5cc79b5 100644 --- a/changes/bug15083 +++ b/changes/bug15083 @@ -1,4 +1,4 @@ - o Major bugfixes (relay, stability): + o Major bugfixes (relay, stability, possible security): - Fix a bug that could lead to a relay crashing with an assertion failure if a buffer of exactly the wrong layout was passed to buf_pullup() at exactly the wrong time. Fixes bug 15083;

1 0

[tor/maint-0.2.5] Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit 1a7419c3df300483f111923daca43febc33b368b Merge: 51e3602 6704e18 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 9 11:09:30 2015 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5 changes/bug15083 | 10 ++++++++++ src/or/buffers.c | 11 +++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.2.4] Do not leave empty, invalid chunks in buffers during buf_pullup
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit 71ee53fe9bdf3f64eef9b38de55960185e8be1b5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 3 22:20:17 2015 +0100 Do not leave empty, invalid chunks in buffers during buf_pullup This fixes an assertion failure bug in 15083; bugfix on 0.2.0.10-alpha. Patch from 'cypherpunks' --- changes/bug15083 | 6 ++++++ src/or/buffers.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/bug15083 b/changes/bug15083 new file mode 100644 index 0000000..98d1d0e --- /dev/null +++ b/changes/bug15083 @@ -0,0 +1,6 @@ + o Major bugfixes (relay, stability): + - Fix a bug that could lead to a relay crashing with an assertion + failure if a buffer of exactly the wrong layout was passed + to buf_pullup() at exactly the wrong time. Fixes bug 15083; + bugfix on 0.2.0.10-alpha. Patch from 'cypherpunks'. + diff --git a/src/or/buffers.c b/src/or/buffers.c index 9be0476..7976432 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -426,7 +426,7 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate) size_t n = bytes - dest->datalen; src = dest->next; tor_assert(src); - if (n > src->datalen) { + if (n >= src->datalen) { memcpy(CHUNK_WRITE_PTR(dest), src->data, src->datalen); dest->datalen += src->datalen; dest->next = src->next;

1 0

[tor/maint-0.2.4] Adjust changes header
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit addffcc14ddf40b3cd1bff3fa86a82354e981a03 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 9 11:07:50 2015 -0400 Adjust changes header --- changes/bug15083 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changes/bug15083 b/changes/bug15083 index 2bd0715..5cc79b5 100644 --- a/changes/bug15083 +++ b/changes/bug15083 @@ -1,4 +1,4 @@ - o Major bugfixes (relay, stability): + o Major bugfixes (relay, stability, possible security): - Fix a bug that could lead to a relay crashing with an assertion failure if a buffer of exactly the wrong layout was passed to buf_pullup() at exactly the wrong time. Fixes bug 15083;

1 0

[tor/maint-0.2.4] Make the assert related to 15083 a tiny bit more tolerant
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit 81a994ce77038721df3aa2f77b783db9a52da79e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 3 22:25:26 2015 +0100 Make the assert related to 15083 a tiny bit more tolerant --- changes/bug15083 | 6 +++++- src/or/buffers.c | 9 ++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/changes/bug15083 b/changes/bug15083 index 98d1d0e..2bd0715 100644 --- a/changes/bug15083 +++ b/changes/bug15083 @@ -3,4 +3,8 @@ failure if a buffer of exactly the wrong layout was passed to buf_pullup() at exactly the wrong time. Fixes bug 15083; bugfix on 0.2.0.10-alpha. Patch from 'cypherpunks'. - + + - Do not assert if the 'data' pointer on a buffer is advanced to the very + end of the buffer; log a BUG message instead. Only assert if it is + past that point. Fixes bug 15083; bugfix on 0.2.0.10-alpha. + diff --git a/src/or/buffers.c b/src/or/buffers.c index 7976432..9dfed00 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -2483,7 +2483,14 @@ assert_buf_ok(buf_t *buf) total += ch->datalen; tor_assert(ch->datalen <= ch->memlen); tor_assert(ch->data >= &ch->mem[0]); - tor_assert(ch->data < &ch->mem[0]+ch->memlen); + tor_assert(ch->data <= &ch->mem[0]+ch->memlen); + if (ch->data == &ch->mem[0]+ch->memlen) { + static int warned = 0; + if (! warned) { + log_warn(LD_BUG, "Invariant violation in buf.c related to #15083"); + warned = 1; + } + } tor_assert(ch->data+ch->datalen <= &ch->mem[0] + ch->memlen); if (!ch->next) tor_assert(ch == buf->tail);

1 0

[tor/maint-0.2.4] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit 6704e18dd2e09111eeca0c76fb00a459f9da98ea Merge: 2bcb596 addffcc Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 9 11:08:57 2015 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 changes/bug15083 | 10 ++++++++++ src/or/buffers.c | 11 +++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-)

1 0