February 2016 - tor-commits - lists.torproject.org

[tor/master] Merge branch 'maint-0.2.7'
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit 7788ee43e519a8f39e3917c4161e7c635cd2ecd9 Merge: 838d4de be6174f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 13:04:43 2016 -0500 Merge branch 'maint-0.2.7' changes/bug18162 | 7 +++++++ src/common/container.c | 36 +++++++++++++++++++----------------- 2 files changed, 26 insertions(+), 17 deletions(-) diff --cc src/common/container.c index 9f40dfa,8c66bd8..2e42c9e --- a/src/common/container.c +++ b/src/common/container.c @@@ -59,11 -58,16 +59,16 @@@ smartlist_clear(smartlist_t *sl sl->num_used = 0; } + #if SIZE_MAX < INT_MAX + #error "We don't support systems where size_t is smaller than int." + #endif + /** Make sure that sl can hold at least size entries. */ -static INLINE void +static inline void - smartlist_ensure_capacity(smartlist_t *sl, int size) + smartlist_ensure_capacity(smartlist_t *sl, size_t size) { - #if SIZEOF_SIZE_T > SIZEOF_INT + /* Set MAX_CAPACITY to MIN(INT_MAX, SIZE_MAX / sizeof(void*)) */ + #if (SIZE_MAX/SIZEOF_VOID_P) > INT_MAX #define MAX_CAPACITY (INT_MAX) #else #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*)))) @@@ -83,11 -83,10 +84,11 @@@ while (size > higher) higher *= 2; } - tor_assert(higher <= INT_MAX); /* Redundant */ - sl->capacity = (int) higher; sl->list = tor_reallocarray(sl->list, sizeof(void *), - ((size_t)sl->capacity)); + ((size_t)higher)); + memset(sl->list + sl->capacity, 0, + sizeof(void *) * (higher - sl->capacity)); - sl->capacity = higher; ++ sl->capacity = (int) higher; } #undef ASSERT_CAPACITY #undef MAX_CAPACITY

1 0

[tor/master] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit 740421af194b890c24242a834ed03ffc5c4c16ab Merge: 44ad3be ce289e2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:57:28 2016 -0500 Merge branch 'maint-0.2.5' into maint-0.2.6 changes/bug18162 | 7 +++++++ src/common/container.c | 37 ++++++++++++++++++++----------------- 2 files changed, 27 insertions(+), 17 deletions(-) diff --cc src/common/container.c index 864fd8a,c668068..76c129d --- a/src/common/container.c +++ b/src/common/container.c @@@ -66,28 -71,22 +71,25 @@@ smartlist_ensure_capacity(smartlist_t * #define MAX_CAPACITY (INT_MAX) #else #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*)))) - #define ASSERT_CAPACITY #endif - if (size > sl->capacity) { - int higher = sl->capacity; ++ + tor_assert(size <= MAX_CAPACITY); + + if (size > (size_t) sl->capacity) { + size_t higher = (size_t) sl->capacity; if (PREDICT_UNLIKELY(size > MAX_CAPACITY/2)) { - #ifdef ASSERT_CAPACITY - /* We don't include this assertion when MAX_CAPACITY == INT_MAX, - * since int size; (size <= INT_MAX) makes analysis tools think we're - * doing something stupid. */ -- tor_assert(size <= MAX_CAPACITY); - #endif higher = MAX_CAPACITY; } else { while (size > higher) higher *= 2; } - sl->capacity = higher; + tor_assert(higher <= INT_MAX); /* Redundant */ + sl->capacity = (int) higher; - sl->list = tor_realloc(sl->list, sizeof(void*)*((size_t)sl->capacity)); + sl->list = tor_reallocarray(sl->list, sizeof(void *), + ((size_t)sl->capacity)); } +#undef ASSERT_CAPACITY +#undef MAX_CAPACITY } /** Append element to the end of the list. */

1 0

[tor/maint-0.2.4] avoid integer overflow in and around smartlist_ensure_capacity.
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit bca7083e8285e8e6a4377076a7e432417eafc6d2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 27 12:26:02 2016 -0500 avoid integer overflow in and around smartlist_ensure_capacity. This closes bug 18162; bugfix on a45b1315909c9, which fixed a related issue long ago. In addition to the #18162 issues, this fixes a signed integer overflow in smarltist_add_all(), which is probably not so great either. --- changes/bug18162 | 7 +++++++ src/common/container.c | 22 +++++++++++++--------- 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/changes/bug18162 b/changes/bug18162 new file mode 100644 index 0000000..0844d6f --- /dev/null +++ b/changes/bug18162 @@ -0,0 +1,7 @@ + o Major bugfixes (security, pointers): + + - Avoid a difficult-to-trigger heap corruption attack when extending + a smartlist to contain over 16GB of pointers. Fixes bug #18162; + bugfix on Tor 0.1.1.11-alpha, which fixed a related bug + incompletely. Reported by Guido Vranken. + diff --git a/src/common/container.c b/src/common/container.c index eec497a..46d9c2e 100644 --- a/src/common/container.c +++ b/src/common/container.c @@ -60,15 +60,17 @@ smartlist_clear(smartlist_t *sl) /** Make sure that sl can hold at least size entries. */ static INLINE void -smartlist_ensure_capacity(smartlist_t *sl, int size) +smartlist_ensure_capacity(smartlist_t *sl, size_t size) { #if SIZEOF_SIZE_T > SIZEOF_INT #define MAX_CAPACITY (INT_MAX) #else #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*)))) #endif - if (size > sl->capacity) { - int higher = sl->capacity; + tor_assert(size <= MAX_CAPACITY); + + if (size > (size_t) sl->capacity) { + size_t higher = (size_t) sl->capacity; if (PREDICT_UNLIKELY(size > MAX_CAPACITY/2)) { tor_assert(size <= MAX_CAPACITY); higher = MAX_CAPACITY; @@ -76,7 +78,8 @@ smartlist_ensure_capacity(smartlist_t *sl, int size) while (size > higher) higher *= 2; } - sl->capacity = higher; + tor_assert(higher <= INT_MAX); /* Redundant */ + sl->capacity = (int) higher; sl->list = tor_realloc(sl->list, sizeof(void*)*((size_t)sl->capacity)); } } @@ -85,7 +88,7 @@ smartlist_ensure_capacity(smartlist_t *sl, int size) void smartlist_add(smartlist_t *sl, void *element) { - smartlist_ensure_capacity(sl, sl->num_used+1); + smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1); sl->list[sl->num_used++] = element; } @@ -93,11 +96,12 @@ smartlist_add(smartlist_t *sl, void *element) void smartlist_add_all(smartlist_t *s1, const smartlist_t *s2) { - int new_size = s1->num_used + s2->num_used; - tor_assert(new_size >= s1->num_used); /* check for overflow. */ + size_t new_size = (size_t)s1->num_used + (size_t)s2->num_used; + tor_assert(new_size >= (size_t) s1->num_used); /* check for overflow. */ smartlist_ensure_capacity(s1, new_size); memcpy(s1->list + s1->num_used, s2->list, s2->num_used*sizeof(void*)); - s1->num_used = new_size; + tor_assert(new_size <= INT_MAX); /* redundant. */ + s1->num_used = (int) new_size; } /** Remove all elements E from sl such that E==element. Preserve @@ -334,7 +338,7 @@ smartlist_insert(smartlist_t *sl, int idx, void *val) if (idx == sl->num_used) { smartlist_add(sl, val); } else { - smartlist_ensure_capacity(sl, sl->num_used+1); + smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1); /* Move other elements away */ if (idx < sl->num_used) memmove(sl->list + idx + 1, sl->list + idx,

1 0

[tor/maint-0.2.4] Make ensure_capacity a bit more pedantically correct
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit c2fd64846978290b0e7c7165d7658a5e704eee8f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:54:52 2016 -0500 Make ensure_capacity a bit more pedantically correct Issues noted by cypherpunks on #18162 --- src/common/container.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/common/container.c b/src/common/container.c index 46d9c2e..b1431df 100644 --- a/src/common/container.c +++ b/src/common/container.c @@ -58,11 +58,16 @@ smartlist_clear(smartlist_t *sl) sl->num_used = 0; } +#if SIZE_MAX < INT_MAX +#error "We don't support systems where size_t is smaller than int." +#endif + /** Make sure that sl can hold at least size entries. */ static INLINE void smartlist_ensure_capacity(smartlist_t *sl, size_t size) { -#if SIZEOF_SIZE_T > SIZEOF_INT + /* Set MAX_CAPACITY to MIN(INT_MAX, SIZE_MAX / sizeof(void*)) */ +#if (SIZE_MAX/SIZEOF_VOID_P) > INT_MAX #define MAX_CAPACITY (INT_MAX) #else #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*))))

1 0

[tor/maint-0.2.4] Merge branch 'bug18162_024' into maint-0.2.4
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit ad95d64fece2c6d2eddffc8fa5178c3ffccc0cd7 Merge: d5ac79e c2fd648 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:55:25 2016 -0500 Merge branch 'bug18162_024' into maint-0.2.4 changes/bug18162 | 7 +++++++ src/common/container.c | 29 +++++++++++++++++++---------- 2 files changed, 26 insertions(+), 10 deletions(-)

1 0

[tor/maint-0.2.5] avoid integer overflow in and around smartlist_ensure_capacity.
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit bca7083e8285e8e6a4377076a7e432417eafc6d2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 27 12:26:02 2016 -0500 avoid integer overflow in and around smartlist_ensure_capacity. This closes bug 18162; bugfix on a45b1315909c9, which fixed a related issue long ago. In addition to the #18162 issues, this fixes a signed integer overflow in smarltist_add_all(), which is probably not so great either. --- changes/bug18162 | 7 +++++++ src/common/container.c | 22 +++++++++++++--------- 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/changes/bug18162 b/changes/bug18162 new file mode 100644 index 0000000..0844d6f --- /dev/null +++ b/changes/bug18162 @@ -0,0 +1,7 @@ + o Major bugfixes (security, pointers): + + - Avoid a difficult-to-trigger heap corruption attack when extending + a smartlist to contain over 16GB of pointers. Fixes bug #18162; + bugfix on Tor 0.1.1.11-alpha, which fixed a related bug + incompletely. Reported by Guido Vranken. + diff --git a/src/common/container.c b/src/common/container.c index eec497a..46d9c2e 100644 --- a/src/common/container.c +++ b/src/common/container.c @@ -60,15 +60,17 @@ smartlist_clear(smartlist_t *sl) /** Make sure that sl can hold at least size entries. */ static INLINE void -smartlist_ensure_capacity(smartlist_t *sl, int size) +smartlist_ensure_capacity(smartlist_t *sl, size_t size) { #if SIZEOF_SIZE_T > SIZEOF_INT #define MAX_CAPACITY (INT_MAX) #else #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*)))) #endif - if (size > sl->capacity) { - int higher = sl->capacity; + tor_assert(size <= MAX_CAPACITY); + + if (size > (size_t) sl->capacity) { + size_t higher = (size_t) sl->capacity; if (PREDICT_UNLIKELY(size > MAX_CAPACITY/2)) { tor_assert(size <= MAX_CAPACITY); higher = MAX_CAPACITY; @@ -76,7 +78,8 @@ smartlist_ensure_capacity(smartlist_t *sl, int size) while (size > higher) higher *= 2; } - sl->capacity = higher; + tor_assert(higher <= INT_MAX); /* Redundant */ + sl->capacity = (int) higher; sl->list = tor_realloc(sl->list, sizeof(void*)*((size_t)sl->capacity)); } } @@ -85,7 +88,7 @@ smartlist_ensure_capacity(smartlist_t *sl, int size) void smartlist_add(smartlist_t *sl, void *element) { - smartlist_ensure_capacity(sl, sl->num_used+1); + smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1); sl->list[sl->num_used++] = element; } @@ -93,11 +96,12 @@ smartlist_add(smartlist_t *sl, void *element) void smartlist_add_all(smartlist_t *s1, const smartlist_t *s2) { - int new_size = s1->num_used + s2->num_used; - tor_assert(new_size >= s1->num_used); /* check for overflow. */ + size_t new_size = (size_t)s1->num_used + (size_t)s2->num_used; + tor_assert(new_size >= (size_t) s1->num_used); /* check for overflow. */ smartlist_ensure_capacity(s1, new_size); memcpy(s1->list + s1->num_used, s2->list, s2->num_used*sizeof(void*)); - s1->num_used = new_size; + tor_assert(new_size <= INT_MAX); /* redundant. */ + s1->num_used = (int) new_size; } /** Remove all elements E from sl such that E==element. Preserve @@ -334,7 +338,7 @@ smartlist_insert(smartlist_t *sl, int idx, void *val) if (idx == sl->num_used) { smartlist_add(sl, val); } else { - smartlist_ensure_capacity(sl, sl->num_used+1); + smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1); /* Move other elements away */ if (idx < sl->num_used) memmove(sl->list + idx + 1, sl->list + idx,

1 0

[tor/maint-0.2.5] Make ensure_capacity a bit more pedantically correct
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit c2fd64846978290b0e7c7165d7658a5e704eee8f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:54:52 2016 -0500 Make ensure_capacity a bit more pedantically correct Issues noted by cypherpunks on #18162 --- src/common/container.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/common/container.c b/src/common/container.c index 46d9c2e..b1431df 100644 --- a/src/common/container.c +++ b/src/common/container.c @@ -58,11 +58,16 @@ smartlist_clear(smartlist_t *sl) sl->num_used = 0; } +#if SIZE_MAX < INT_MAX +#error "We don't support systems where size_t is smaller than int." +#endif + /** Make sure that sl can hold at least size entries. */ static INLINE void smartlist_ensure_capacity(smartlist_t *sl, size_t size) { -#if SIZEOF_SIZE_T > SIZEOF_INT + /* Set MAX_CAPACITY to MIN(INT_MAX, SIZE_MAX / sizeof(void*)) */ +#if (SIZE_MAX/SIZEOF_VOID_P) > INT_MAX #define MAX_CAPACITY (INT_MAX) #else #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*))))

1 0

[tor/maint-0.2.5] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit ce289e2cb5099a4abe4468049dc0d262b65bfa17 Merge: f06d9a9 ad95d64 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:55:40 2016 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug18162 | 7 +++++++ src/common/container.c | 29 +++++++++++++++++++---------- 2 files changed, 26 insertions(+), 10 deletions(-)

1 0

[tor/maint-0.2.5] Merge branch 'bug18162_024' into maint-0.2.4
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit ad95d64fece2c6d2eddffc8fa5178c3ffccc0cd7 Merge: d5ac79e c2fd648 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:55:25 2016 -0500 Merge branch 'bug18162_024' into maint-0.2.4 changes/bug18162 | 7 +++++++ src/common/container.c | 29 +++++++++++++++++++---------- 2 files changed, 26 insertions(+), 10 deletions(-)

1 0

[tor/master] make check-spaces
by nickm＠torproject.org 11 Feb '16

11 Feb '16

commit 838d4dee121b311647ae4edd7e220436571c449c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 11 12:50:55 2016 -0500 make check-spaces --- src/or/entrynodes.c | 5 +++-- src/or/or.h | 4 ++-- src/or/policies.c | 15 ++++++++------- src/test/test_policy.c | 1 - 4 files changed, 13 insertions(+), 12 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index a4b9350..95d9fec 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -2124,8 +2124,9 @@ launch_direct_bridge_descriptor_fetch(bridge_info_t *bridge) * it. If we */ if (!fascist_firewall_allows_address_addr(&bridge->addr, bridge->port, FIREWALL_OR_CONNECTION, 0)) { - log_notice(LD_CONFIG, "Tried to fetch a descriptor directly from a bridge, " - "but that bridge is not reachable through our firewall."); + log_notice(LD_CONFIG, "Tried to fetch a descriptor directly from a " + "bridge, but that bridge is not reachable through our " + "firewall."); return; } diff --git a/src/or/or.h b/src/or/or.h index 04bd42a..f438212 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4092,8 +4092,8 @@ typedef struct { int ClientUseIPv6; /** If true, prefer an IPv6 OR port over an IPv4 one for entry node * connections. If auto, bridge clients prefer IPv6, and other clients - * prefer IPv4. Use fascist_firewall_prefer_ipv6_orport() instead of accessing - * this value directly. */ + * prefer IPv4. Use fascist_firewall_prefer_ipv6_orport() instead of + * accessing this value directly. */ int ClientPreferIPv6ORPort; /** If true, prefer an IPv6 directory port over an IPv4 one for direct * directory connections. If auto, bridge clients prefer IPv6, and other diff --git a/src/or/policies.c b/src/or/policies.c index faa39ad..984ab6a 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -421,7 +421,8 @@ fascist_firewall_allows_address(const tor_addr_t *addr, /** Is this client configured to use IPv6? */ -int fascist_firewall_use_ipv6(const or_options_t *options) +int +fascist_firewall_use_ipv6(const or_options_t *options) { /* Clients use IPv6 if it's set, or they use bridges, or they don't use * IPv4 */ @@ -513,14 +514,14 @@ fascist_firewall_allows_address_addr(const tor_addr_t *addr, uint16_t port, if (fw_connection == FIREWALL_OR_CONNECTION) { return fascist_firewall_allows_address(addr, port, - reachable_or_addr_policy, - pref_only, - fascist_firewall_prefer_ipv6_orport(options)); + reachable_or_addr_policy, + pref_only, + fascist_firewall_prefer_ipv6_orport(options)); } else if (fw_connection == FIREWALL_DIR_CONNECTION) { return fascist_firewall_allows_address(addr, port, - reachable_dir_addr_policy, - pref_only, - fascist_firewall_prefer_ipv6_dirport(options)); + reachable_dir_addr_policy, + pref_only, + fascist_firewall_prefer_ipv6_dirport(options)); } else { log_warn(LD_BUG, "Bad firewall_connection_t value %d.", fw_connection); diff --git a/src/test/test_policy.c b/src/test/test_policy.c index c044d9f..3688909 100644 --- a/src/test/test_policy.c +++ b/src/test/test_policy.c @@ -1546,7 +1546,6 @@ test_policies_fascist_firewall_choose_address(void *arg) FIREWALL_DIR_CONNECTION, 1) == &ipv6_dir_ap); - /* In the default configuration (Auto / IPv6 off), bridge clients should * still use IPv6, and only prefer it for bridges configured with an IPv6 * address, regardless of ClientUseIPv6. */

1 0