February 2016 - tor-commits - lists.torproject.org

[tor/maint-0.2.7] Merge branch 'bug18162_024' into maint-0.2.4
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit ad95d64fece2c6d2eddffc8fa5178c3ffccc0cd7 Merge: d5ac79e c2fd648 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:55:25 2016 -0500 Merge branch 'bug18162_024' into maint-0.2.4 changes/bug18162 | 7 +++++++ src/common/container.c | 29 +++++++++++++++++++---------- 2 files changed, 26 insertions(+), 10 deletions(-)

1 0

[tor/maint-0.2.7] avoid integer overflow in and around smartlist_ensure_capacity.
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit bca7083e8285e8e6a4377076a7e432417eafc6d2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 27 12:26:02 2016 -0500 avoid integer overflow in and around smartlist_ensure_capacity. This closes bug 18162; bugfix on a45b1315909c9, which fixed a related issue long ago. In addition to the #18162 issues, this fixes a signed integer overflow in smarltist_add_all(), which is probably not so great either. --- changes/bug18162 | 7 +++++++ src/common/container.c | 22 +++++++++++++--------- 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/changes/bug18162 b/changes/bug18162 new file mode 100644 index 0000000..0844d6f --- /dev/null +++ b/changes/bug18162 @@ -0,0 +1,7 @@ + o Major bugfixes (security, pointers): + + - Avoid a difficult-to-trigger heap corruption attack when extending + a smartlist to contain over 16GB of pointers. Fixes bug #18162; + bugfix on Tor 0.1.1.11-alpha, which fixed a related bug + incompletely. Reported by Guido Vranken. + diff --git a/src/common/container.c b/src/common/container.c index eec497a..46d9c2e 100644 --- a/src/common/container.c +++ b/src/common/container.c @@ -60,15 +60,17 @@ smartlist_clear(smartlist_t *sl) /** Make sure that sl can hold at least size entries. */ static INLINE void -smartlist_ensure_capacity(smartlist_t *sl, int size) +smartlist_ensure_capacity(smartlist_t *sl, size_t size) { #if SIZEOF_SIZE_T > SIZEOF_INT #define MAX_CAPACITY (INT_MAX) #else #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*)))) #endif - if (size > sl->capacity) { - int higher = sl->capacity; + tor_assert(size <= MAX_CAPACITY); + + if (size > (size_t) sl->capacity) { + size_t higher = (size_t) sl->capacity; if (PREDICT_UNLIKELY(size > MAX_CAPACITY/2)) { tor_assert(size <= MAX_CAPACITY); higher = MAX_CAPACITY; @@ -76,7 +78,8 @@ smartlist_ensure_capacity(smartlist_t *sl, int size) while (size > higher) higher *= 2; } - sl->capacity = higher; + tor_assert(higher <= INT_MAX); /* Redundant */ + sl->capacity = (int) higher; sl->list = tor_realloc(sl->list, sizeof(void*)*((size_t)sl->capacity)); } } @@ -85,7 +88,7 @@ smartlist_ensure_capacity(smartlist_t *sl, int size) void smartlist_add(smartlist_t *sl, void *element) { - smartlist_ensure_capacity(sl, sl->num_used+1); + smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1); sl->list[sl->num_used++] = element; } @@ -93,11 +96,12 @@ smartlist_add(smartlist_t *sl, void *element) void smartlist_add_all(smartlist_t *s1, const smartlist_t *s2) { - int new_size = s1->num_used + s2->num_used; - tor_assert(new_size >= s1->num_used); /* check for overflow. */ + size_t new_size = (size_t)s1->num_used + (size_t)s2->num_used; + tor_assert(new_size >= (size_t) s1->num_used); /* check for overflow. */ smartlist_ensure_capacity(s1, new_size); memcpy(s1->list + s1->num_used, s2->list, s2->num_used*sizeof(void*)); - s1->num_used = new_size; + tor_assert(new_size <= INT_MAX); /* redundant. */ + s1->num_used = (int) new_size; } /** Remove all elements E from sl such that E==element. Preserve @@ -334,7 +338,7 @@ smartlist_insert(smartlist_t *sl, int idx, void *val) if (idx == sl->num_used) { smartlist_add(sl, val); } else { - smartlist_ensure_capacity(sl, sl->num_used+1); + smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1); /* Move other elements away */ if (idx < sl->num_used) memmove(sl->list + idx + 1, sl->list + idx,

1 0

[tor/maint-0.2.7] Merge branch 'maint-0.2.6' into maint-0.2.7
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit be6174f8f6aaaf8f990eb56c5cba16bc5ec0fcea Merge: d920cbb 740421a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 13:01:46 2016 -0500 Merge branch 'maint-0.2.6' into maint-0.2.7 changes/bug18162 | 7 +++++++ src/common/container.c | 37 ++++++++++++++++++++----------------- 2 files changed, 27 insertions(+), 17 deletions(-)

1 0

[tor/master] Merge branch 'bug18162_024' into maint-0.2.4
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit ad95d64fece2c6d2eddffc8fa5178c3ffccc0cd7 Merge: d5ac79e c2fd648 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:55:25 2016 -0500 Merge branch 'bug18162_024' into maint-0.2.4 changes/bug18162 | 7 +++++++ src/common/container.c | 29 +++++++++++++++++++---------- 2 files changed, 26 insertions(+), 10 deletions(-)

1 0

[tor/master] avoid integer overflow in and around smartlist_ensure_capacity.
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit bca7083e8285e8e6a4377076a7e432417eafc6d2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 27 12:26:02 2016 -0500 avoid integer overflow in and around smartlist_ensure_capacity. This closes bug 18162; bugfix on a45b1315909c9, which fixed a related issue long ago. In addition to the #18162 issues, this fixes a signed integer overflow in smarltist_add_all(), which is probably not so great either. --- changes/bug18162 | 7 +++++++ src/common/container.c | 22 +++++++++++++--------- 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/changes/bug18162 b/changes/bug18162 new file mode 100644 index 0000000..0844d6f --- /dev/null +++ b/changes/bug18162 @@ -0,0 +1,7 @@ + o Major bugfixes (security, pointers): + + - Avoid a difficult-to-trigger heap corruption attack when extending + a smartlist to contain over 16GB of pointers. Fixes bug #18162; + bugfix on Tor 0.1.1.11-alpha, which fixed a related bug + incompletely. Reported by Guido Vranken. + diff --git a/src/common/container.c b/src/common/container.c index eec497a..46d9c2e 100644 --- a/src/common/container.c +++ b/src/common/container.c @@ -60,15 +60,17 @@ smartlist_clear(smartlist_t *sl) /** Make sure that sl can hold at least size entries. */ static INLINE void -smartlist_ensure_capacity(smartlist_t *sl, int size) +smartlist_ensure_capacity(smartlist_t *sl, size_t size) { #if SIZEOF_SIZE_T > SIZEOF_INT #define MAX_CAPACITY (INT_MAX) #else #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*)))) #endif - if (size > sl->capacity) { - int higher = sl->capacity; + tor_assert(size <= MAX_CAPACITY); + + if (size > (size_t) sl->capacity) { + size_t higher = (size_t) sl->capacity; if (PREDICT_UNLIKELY(size > MAX_CAPACITY/2)) { tor_assert(size <= MAX_CAPACITY); higher = MAX_CAPACITY; @@ -76,7 +78,8 @@ smartlist_ensure_capacity(smartlist_t *sl, int size) while (size > higher) higher *= 2; } - sl->capacity = higher; + tor_assert(higher <= INT_MAX); /* Redundant */ + sl->capacity = (int) higher; sl->list = tor_realloc(sl->list, sizeof(void*)*((size_t)sl->capacity)); } } @@ -85,7 +88,7 @@ smartlist_ensure_capacity(smartlist_t *sl, int size) void smartlist_add(smartlist_t *sl, void *element) { - smartlist_ensure_capacity(sl, sl->num_used+1); + smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1); sl->list[sl->num_used++] = element; } @@ -93,11 +96,12 @@ smartlist_add(smartlist_t *sl, void *element) void smartlist_add_all(smartlist_t *s1, const smartlist_t *s2) { - int new_size = s1->num_used + s2->num_used; - tor_assert(new_size >= s1->num_used); /* check for overflow. */ + size_t new_size = (size_t)s1->num_used + (size_t)s2->num_used; + tor_assert(new_size >= (size_t) s1->num_used); /* check for overflow. */ smartlist_ensure_capacity(s1, new_size); memcpy(s1->list + s1->num_used, s2->list, s2->num_used*sizeof(void*)); - s1->num_used = new_size; + tor_assert(new_size <= INT_MAX); /* redundant. */ + s1->num_used = (int) new_size; } /** Remove all elements E from sl such that E==element. Preserve @@ -334,7 +338,7 @@ smartlist_insert(smartlist_t *sl, int idx, void *val) if (idx == sl->num_used) { smartlist_add(sl, val); } else { - smartlist_ensure_capacity(sl, sl->num_used+1); + smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1); /* Move other elements away */ if (idx < sl->num_used) memmove(sl->list + idx + 1, sl->list + idx,

1 0

[tor/master] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit ce289e2cb5099a4abe4468049dc0d262b65bfa17 Merge: f06d9a9 ad95d64 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:55:40 2016 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug18162 | 7 +++++++ src/common/container.c | 29 +++++++++++++++++++---------- 2 files changed, 26 insertions(+), 10 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.2.6' into maint-0.2.7
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit be6174f8f6aaaf8f990eb56c5cba16bc5ec0fcea Merge: d920cbb 740421a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 13:01:46 2016 -0500 Merge branch 'maint-0.2.6' into maint-0.2.7 changes/bug18162 | 7 +++++++ src/common/container.c | 37 ++++++++++++++++++++----------------- 2 files changed, 27 insertions(+), 17 deletions(-)

1 0

[tor/master] Make ensure_capacity a bit more pedantically correct
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit c2fd64846978290b0e7c7165d7658a5e704eee8f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:54:52 2016 -0500 Make ensure_capacity a bit more pedantically correct Issues noted by cypherpunks on #18162 --- src/common/container.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/common/container.c b/src/common/container.c index 46d9c2e..b1431df 100644 --- a/src/common/container.c +++ b/src/common/container.c @@ -58,11 +58,16 @@ smartlist_clear(smartlist_t *sl) sl->num_used = 0; } +#if SIZE_MAX < INT_MAX +#error "We don't support systems where size_t is smaller than int." +#endif + /** Make sure that sl can hold at least size entries. */ static INLINE void smartlist_ensure_capacity(smartlist_t *sl, size_t size) { -#if SIZEOF_SIZE_T > SIZEOF_INT + /* Set MAX_CAPACITY to MIN(INT_MAX, SIZE_MAX / sizeof(void*)) */ +#if (SIZE_MAX/SIZEOF_VOID_P) > INT_MAX #define MAX_CAPACITY (INT_MAX) #else #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*))))

1 0

[tor/maint-0.2.7] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit ce289e2cb5099a4abe4468049dc0d262b65bfa17 Merge: f06d9a9 ad95d64 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:55:40 2016 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug18162 | 7 +++++++ src/common/container.c | 29 +++++++++++++++++++---------- 2 files changed, 26 insertions(+), 10 deletions(-)

1 0

[tor/maint-0.2.7] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit 740421af194b890c24242a834ed03ffc5c4c16ab Merge: 44ad3be ce289e2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:57:28 2016 -0500 Merge branch 'maint-0.2.5' into maint-0.2.6 changes/bug18162 | 7 +++++++ src/common/container.c | 37 ++++++++++++++++++++----------------- 2 files changed, 27 insertions(+), 17 deletions(-) diff --cc src/common/container.c index 864fd8a,c668068..76c129d --- a/src/common/container.c +++ b/src/common/container.c @@@ -66,28 -71,22 +71,25 @@@ smartlist_ensure_capacity(smartlist_t * #define MAX_CAPACITY (INT_MAX) #else #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*)))) - #define ASSERT_CAPACITY #endif - if (size > sl->capacity) { - int higher = sl->capacity; ++ + tor_assert(size <= MAX_CAPACITY); + + if (size > (size_t) sl->capacity) { + size_t higher = (size_t) sl->capacity; if (PREDICT_UNLIKELY(size > MAX_CAPACITY/2)) { - #ifdef ASSERT_CAPACITY - /* We don't include this assertion when MAX_CAPACITY == INT_MAX, - * since int size; (size <= INT_MAX) makes analysis tools think we're - * doing something stupid. */ -- tor_assert(size <= MAX_CAPACITY); - #endif higher = MAX_CAPACITY; } else { while (size > higher) higher *= 2; } - sl->capacity = higher; + tor_assert(higher <= INT_MAX); /* Redundant */ + sl->capacity = (int) higher; - sl->list = tor_realloc(sl->list, sizeof(void*)*((size_t)sl->capacity)); + sl->list = tor_reallocarray(sl->list, sizeof(void *), + ((size_t)sl->capacity)); } +#undef ASSERT_CAPACITY +#undef MAX_CAPACITY } /** Append element to the end of the list. */

1 0