May 2015 - tor-commits - lists.torproject.org

[tor/master] Avoid double-free on rend_add_service() failure
by nickm＠torproject.org 28 May '15

28 May '15

commit 5dce1829bf8615f78975e1b7d651e97c266b509a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 13:23:09 2015 -0400 Avoid double-free on rend_add_service() failure Rend_add_service() frees its argument on failure; no need to free again. Fixes bug 16228, bugfix on 0.2.7.1-alpha Found by coverity; this is CID 1301387. --- changes/bug16228 | 4 ++++ src/or/rendservice.c | 3 +-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/changes/bug16228 b/changes/bug16228 new file mode 100644 index 0000000..bf36cf8 --- /dev/null +++ b/changes/bug16228 @@ -0,0 +1,4 @@ + o Minor bugfixes (hidden services): + - Avoid crashing with a double-free bug when we create an + ephemeral hidden service but adding it fails for some reason. + Fixes bug 16228; bugfix on 0.2.7.1-alpha. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 0329d70..d27b06d 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -256,7 +256,7 @@ rend_service_free_all(void) } /** Validate service and add it to rend_service_list if possible. - * Return 0 on success and -1 on failure. + * Return 0 on success. On failure, free service and return -1. */ static int rend_add_service(rend_service_t *service) @@ -868,7 +868,6 @@ rend_service_add_ephemeral(crypto_pk_t *pk, /* Initialize the service. */ if (rend_add_service(s)) { - rend_service_free(s); return RSAE_INTERNAL; } *service_id_out = tor_strdup(s->service_id);

1 0

[tor/master] There sure are a lot of these in test_hs.c. CID 1301385
by nickm＠torproject.org 28 May '15

28 May '15

commit 97a2dbb3e33c3444390e345c248663a928f8df09 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 13:17:24 2015 -0400 There sure are a lot of these in test_hs.c. CID 1301385 --- src/test/test_hs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/test/test_hs.c b/src/test/test_hs.c index 6008518..fc265bc 100644 --- a/src/test/test_hs.c +++ b/src/test/test_hs.c @@ -304,7 +304,7 @@ static void test_hs_rend_data(void *arg) { int rep; - rend_data_t *client = NULL; + rend_data_t *client = NULL, *client_dup = NULL; /* Binary format of a descriptor ID. */ char desc_id[DIGEST_LEN]; char client_cookie[REND_DESC_COOKIE_LEN]; @@ -340,7 +340,7 @@ test_hs_rend_data(void *arg) tt_int_op(tor_digest_is_zero(client->rend_cookie), ==, 1); /* Test dup(). */ - rend_data_t *client_dup = rend_data_dup(client); + client_dup = rend_data_dup(client); tt_assert(client_dup); tt_int_op(client_dup->auth_type, ==, client->auth_type); tt_str_op(client_dup->onion_address, OP_EQ, client->onion_address); @@ -359,7 +359,9 @@ test_hs_rend_data(void *arg) tt_int_op(tor_digest_is_zero(client_dup->rend_pk_digest), ==, 1); tt_int_op(tor_digest_is_zero(client_dup->rend_cookie), ==, 1); rend_data_free(client); + client = NULL; rend_data_free(client_dup); + client_dup = NULL; /* Reset state. */ base32_decode(desc_id, sizeof(desc_id), STR_DESC_ID_BASE32, @@ -431,6 +433,7 @@ test_hs_rend_data(void *arg) rend_data_free(service); rend_data_free(service_dup); rend_data_free(client); + rend_data_free(client_dup); } struct testcase_t hs_tests[] = {

1 0

[tor/master] Another test_hs leak. CID 1301383.
by nickm＠torproject.org 28 May '15

28 May '15

commit 9f289e3b9ed4c60a2c1b1ed18ee18d9b4ce9ece9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 13:13:15 2015 -0400 Another test_hs leak. CID 1301383. --- src/test/test_hs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/test/test_hs.c b/src/test/test_hs.c index 425c2b6..6008518 100644 --- a/src/test/test_hs.c +++ b/src/test/test_hs.c @@ -304,7 +304,7 @@ static void test_hs_rend_data(void *arg) { int rep; - rend_data_t *client; + rend_data_t *client = NULL; /* Binary format of a descriptor ID. */ char desc_id[DIGEST_LEN]; char client_cookie[REND_DESC_COOKIE_LEN]; @@ -384,6 +384,7 @@ test_hs_rend_data(void *arg) tt_int_op(tor_digest_is_zero(client->rend_pk_digest), ==, 1); tt_int_op(tor_digest_is_zero(client->rend_cookie), ==, 1); rend_data_free(client); + client = NULL; /* Let's test the service object now. */ char rend_pk_digest[DIGEST_LEN]; @@ -429,6 +430,7 @@ test_hs_rend_data(void *arg) done: rend_data_free(service); rend_data_free(service_dup); + rend_data_free(client); } struct testcase_t hs_tests[] = {

1 0

[tor/master] Memory leak in tor_cert_parse. CID 1301382.
by nickm＠torproject.org 28 May '15

28 May '15

commit 83ad7d2fbbac108a9e6bcb873a229a0efeea6a60 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 13:11:54 2015 -0400 Memory leak in tor_cert_parse. CID 1301382. --- src/test/test_routerkeys.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/test/test_routerkeys.c b/src/test/test_routerkeys.c index fbe5686..a60cba7 100644 --- a/src/test/test_routerkeys.c +++ b/src/test/test_routerkeys.c @@ -540,6 +540,7 @@ test_routerkeys_ed_keys_init_all(void *arg) done: tor_free(dir); tor_free(options); + tor_cert_free(link_cert); routerkeys_free_all(); }

1 0

[tor/master] Fix a bug in earlier torcert fix, fix another.
by nickm＠torproject.org 28 May '15

28 May '15

commit 49c31877b6dd75c268898849941ae44056bf42df Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 13:14:30 2015 -0400 Fix a bug in earlier torcert fix, fix another. --- src/or/torcert.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/or/torcert.c b/src/or/torcert.c index 095cbb8..838501e 100644 --- a/src/or/torcert.c +++ b/src/or/torcert.c @@ -68,13 +68,15 @@ tor_cert_sign_impl(const ed25519_keypair_t *signing_key, tor_free(encoded); - return torcert; + goto done; err: tor_cert_free(torcert); + torcert = NULL; + done: ed25519_cert_free(cert); tor_free(encoded); - return NULL; + return torcert; } /** @@ -151,7 +153,7 @@ tor_cert_parse(const uint8_t *encoded, const size_t len) cert = NULL; done: ed25519_cert_free(parsed); - return NULL; + return cert; } /** Fill in checkable_out with the information needed to check

1 0

[tor/master] Memory leak in test_hs_rend_data
by nickm＠torproject.org 28 May '15

28 May '15

commit 0585d4e94bcced179a52dc459578ddb00dc61344 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 13:01:48 2015 -0400 Memory leak in test_hs_rend_data CID 1301377 --- src/test/test_hs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/test/test_hs.c b/src/test/test_hs.c index dd49cd3..425c2b6 100644 --- a/src/test/test_hs.c +++ b/src/test/test_hs.c @@ -309,6 +309,8 @@ test_hs_rend_data(void *arg) char desc_id[DIGEST_LEN]; char client_cookie[REND_DESC_COOKIE_LEN]; time_t now = time(NULL); + rend_data_t *service_dup = NULL; + rend_data_t *service = NULL; (void)arg; @@ -384,7 +386,6 @@ test_hs_rend_data(void *arg) rend_data_free(client); /* Let's test the service object now. */ - rend_data_t *service; char rend_pk_digest[DIGEST_LEN]; uint8_t rend_cookie[DIGEST_LEN]; memset(rend_pk_digest, 'f', sizeof(rend_pk_digest)); @@ -408,7 +409,7 @@ test_hs_rend_data(void *arg) tt_int_op(tor_digest_is_zero(service->desc_id_fetch), ==, 1); /* Test dup(). */ - rend_data_t *service_dup = rend_data_dup(service); + service_dup = rend_data_dup(service); tt_assert(service_dup); tt_int_op(service_dup->auth_type, ==, service->auth_type); tt_str_op(service_dup->onion_address, OP_EQ, service->onion_address); @@ -424,11 +425,10 @@ test_hs_rend_data(void *arg) /* The rest should be zeroed because this is a service request. */ tt_int_op(tor_digest_is_zero(service_dup->descriptor_cookie), ==, 1); tt_int_op(tor_digest_is_zero(service_dup->desc_id_fetch), ==, 1); - rend_data_free(service); - rend_data_free(service_dup); done: - return; + rend_data_free(service); + rend_data_free(service_dup); } struct testcase_t hs_tests[] = {

1 0

[tor/master] Fix leak-on-test-failure in test_routerkeys.c
by nickm＠torproject.org 28 May '15

28 May '15

commit 3262f3c3f621073d7a5708eff5715fff4abb1cf9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 13:06:30 2015 -0400 Fix leak-on-test-failure in test_routerkeys.c CID 1301379 --- src/test/test_routerkeys.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/src/test/test_routerkeys.c b/src/test/test_routerkeys.c index f0ac9ff..fbe5686 100644 --- a/src/test/test_routerkeys.c +++ b/src/test/test_routerkeys.c @@ -86,7 +86,7 @@ test_routerkeys_ed_certs(void *args) { (void)args; ed25519_keypair_t kp1, kp2; - tor_cert_t *cert[2] = {NULL, NULL}; + tor_cert_t *cert[2] = {NULL, NULL}, *nocert = NULL; tor_cert_t *parsed_cert[2] = {NULL, NULL}; time_t now = 1412094534; uint8_t *junk = NULL; @@ -156,17 +156,20 @@ test_routerkeys_ed_certs(void *args) /* Now try some junky certs. */ /* - Truncated */ - tt_ptr_op(NULL, ==,tor_cert_parse(cert[0]->encoded, cert[0]->encoded_len-1)); + nocert = tor_cert_parse(cert[0]->encoded, cert[0]->encoded_len-1); + tt_ptr_op(NULL, ==, nocert); /* - First byte modified */ cert[0]->encoded[0] = 99; - tt_ptr_op(NULL, ==,tor_cert_parse(cert[0]->encoded, cert[0]->encoded_len)); + nocert = tor_cert_parse(cert[0]->encoded, cert[0]->encoded_len); + tt_ptr_op(NULL, ==, nocert); cert[0]->encoded[0] = 1; /* - Extra byte at the end*/ junk = tor_malloc_zero(cert[0]->encoded_len + 1); memcpy(junk, cert[0]->encoded, cert[0]->encoded_len); - tt_ptr_op(NULL, ==, tor_cert_parse(junk, cert[0]->encoded_len+1)); + nocert = tor_cert_parse(junk, cert[0]->encoded_len+1); + tt_ptr_op(NULL, ==, nocert); /* - Multiple signing key instances */ tor_free(junk); @@ -179,13 +182,15 @@ test_routerkeys_ed_certs(void *args) junk[42] = 4; /* exttype */ junk[77] = 32; /* extlen */ junk[78] = 4; /* exttype */ - tt_ptr_op(NULL, ==, tor_cert_parse(junk, 104 + 36 * 2)); + nocert = tor_cert_parse(junk, 104 + 36 * 2); + tt_ptr_op(NULL, ==, nocert); done: tor_cert_free(cert[0]); tor_cert_free(cert[1]); tor_cert_free(parsed_cert[0]); tor_cert_free(parsed_cert[1]); + tor_cert_free(nocert); tor_free(junk); tor_free(base64); }

1 0

[tor/master] Memory leak in tor_cert_parse. CID gi1301381
by nickm＠torproject.org 28 May '15

28 May '15

commit 3df6f8591ddefca7ca930c3c83f416ac476c4f2b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 13:09:00 2015 -0400 Memory leak in tor_cert_parse. CID gi1301381 --- src/or/torcert.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/or/torcert.c b/src/or/torcert.c index e2ddffd..095cbb8 100644 --- a/src/or/torcert.c +++ b/src/or/torcert.c @@ -145,10 +145,12 @@ tor_cert_parse(const uint8_t *encoded, const size_t len) } } - return cert; + goto done; err: - ed25519_cert_free(parsed); tor_cert_free(cert); + cert = NULL; + done: + ed25519_cert_free(parsed); return NULL; }

1 0

[tor/master] Fix memory leak on failure to generate EI. CID 1301370.
by nickm＠torproject.org 28 May '15

28 May '15

commit a85d58af62b04f37e16e2840e77e7f158a9586fc Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 12:47:31 2015 -0400 Fix memory leak on failure to generate EI. CID 1301370. --- src/or/router.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/router.c b/src/or/router.c index 6532f97..6868e7b 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -2882,7 +2882,6 @@ extrainfo_dump_to_string(char **s_out, extrainfo_t *extrainfo, extrainfo->nickname, identity, ed_cert_line, published, bandwidth_usage); - tor_free(bandwidth_usage); smartlist_add(chunks, pre); if (geoip_is_loaded(AF_INET)) @@ -3030,6 +3029,7 @@ extrainfo_dump_to_string(char **s_out, extrainfo_t *extrainfo, tor_free(s_dup); tor_free(ed_cert_line); extrainfo_free(ei_tmp); + tor_free(bandwidth_usage); return result; }

1 0

[tor/master] fix memory leak on bad ns convote. CID 1301371.
by nickm＠torproject.org 28 May '15

28 May '15

commit b76815d1107dafd9e1221a04a40033eaae242eb9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 12:49:39 2015 -0400 fix memory leak on bad ns convote. CID 1301371. --- src/or/routerparse.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/or/routerparse.c b/src/or/routerparse.c index c3dc241..1835bf8 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3191,6 +3191,7 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out, if (digest256map_get(ed_id_map, vrs->ed25519_id) != NULL) { log_warn(LD_DIR, "Vote networkstatus ed25519 identities were not " "unique"); + digest256map_free(ed_id_map, NULL); goto err; } digest256map_set(ed_id_map, vrs->ed25519_id, (void*)1);

1 0