February 2017 - tor-commits - lists.torproject.org

[tor/maint-0.2.6] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 15 Feb '17

15 Feb '17

commit f7ed4a7d8f489aeb31246e4b75c30b40bbf94fa6 Merge: 6e7ff9e aeb299b Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 15 07:52:33 2017 -0500 Merge branch 'maint-0.2.5' into maint-0.2.6

1 0

[tor/maint-0.2.6] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 15 Feb '17

15 Feb '17

commit a452b713955422e217f7056cf50cb3591830dee9 Merge: 124062e 194e310 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 15 07:47:04 2017 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug20384 | 10 ++++++++++ changes/trove-2017-001.2 | 8 ++++++++ src/or/routerparse.c | 49 +++++++++++++++++++++++++++++------------------- 3 files changed, 48 insertions(+), 19 deletions(-)

1 0

[tor/maint-0.2.6] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 15 Feb '17

15 Feb '17

commit 3781f24b8014213c200f74973deb550382957a01 Merge: 43c18b1 a452b71 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 15 07:47:12 2017 -0500 Merge branch 'maint-0.2.5' into maint-0.2.6 changes/bug20384 | 10 ++++++++++ changes/trove-2017-001.2 | 8 ++++++++ src/or/routerparse.c | 49 +++++++++++++++++++++++++++++------------------- 3 files changed, 48 insertions(+), 19 deletions(-)

1 0

[tor/maint-0.2.5] Avoid integer underflow in tor_version_compare.
by nickm＠torproject.org 15 Feb '17

15 Feb '17

commit 194e31057fbf07d6bdf4b62d26e1a9db334e5f1c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 10:58:02 2017 -0500 Avoid integer underflow in tor_version_compare. Fix for TROVE-2017-001 and bug 21278. (Note: Instead of handling signed ints "correctly", we keep the old behavior, except for the part where we would crash with -ftrapv.) --- changes/trove-2017-001.2 | 8 ++++++++ src/or/routerparse.c | 49 +++++++++++++++++++++++++++++------------------- 2 files changed, 38 insertions(+), 19 deletions(-) diff --git a/changes/trove-2017-001.2 b/changes/trove-2017-001.2 new file mode 100644 index 0000000..3ef073c --- /dev/null +++ b/changes/trove-2017-001.2 @@ -0,0 +1,8 @@ + o Major bugfixes (parsing): + - Fix an integer underflow bug when comparing malformed Tor versions. + This bug is harmless, except when Tor has been built with + --enable-expensive-hardening, which would turn it into a crash; + or on Tor 0.2.9.1-alpha through Tor 0.2.9.8, which were built with + -ftrapv by default. + Part of TROVE-2017-001. Fixes bug 21278; bugfix on + 0.0.8pre1. Found by OSS-Fuzz. diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 71373ce..1243035 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -4545,26 +4545,37 @@ tor_version_compare(tor_version_t *a, tor_version_t *b) int i; tor_assert(a); tor_assert(b); - if ((i = a->major - b->major)) - return i; - else if ((i = a->minor - b->minor)) - return i; - else if ((i = a->micro - b->micro)) - return i; - else if ((i = a->status - b->status)) - return i; - else if ((i = a->patchlevel - b->patchlevel)) - return i; - else if ((i = strcmp(a->status_tag, b->status_tag))) - return i; - else if ((i = a->svn_revision - b->svn_revision)) - return i; - else if ((i = a->git_tag_len - b->git_tag_len)) - return i; - else if (a->git_tag_len) - return fast_memcmp(a->git_tag, b->git_tag, a->git_tag_len); + + /* We take this approach to comparison to ensure the same (bogus!) behavior + * on all inputs as we would have seen before bug #21278 was fixed. The + * only important difference here is that this method doesn't cause + * a signed integer underflow. + */ +#define CMP(field) do { \ + unsigned aval = (unsigned) a->field; \ + unsigned bval = (unsigned) b->field; \ + int result = (int) (aval - bval); \ + if (result < 0) \ + return -1; \ + else if (result > 0) \ + return 1; \ + } while (0) + + CMP(major); + CMP(minor); + CMP(micro); + CMP(status); + CMP(patchlevel); + if ((i = strcmp(a->status_tag, b->status_tag))) + return i; + CMP(svn_revision); + CMP(git_tag_len); + if (a->git_tag_len) + return fast_memcmp(a->git_tag, b->git_tag, a->git_tag_len); else - return 0; + return 0; + +#undef CMP } /** Return true iff versions a and b belong to the same series.

1 0

[tor/maint-0.2.6] Merge branch 'maint-0.2.6' of git-rw.torproject.org:/tor into maint-0.2.6
by nickm＠torproject.org 15 Feb '17

15 Feb '17

commit 6e7ff9ee31c22bf804f711c6595de55ee2f28257 Merge: 3781f24 e778a41 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 15 07:51:41 2017 -0500 Merge branch 'maint-0.2.6' of git-rw.torproject.org:/tor into maint-0.2.6

1 0

[tor/maint-0.2.6] Avoid integer underflow in tor_version_compare.
by nickm＠torproject.org 15 Feb '17

15 Feb '17

commit 194e31057fbf07d6bdf4b62d26e1a9db334e5f1c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 10:58:02 2017 -0500 Avoid integer underflow in tor_version_compare. Fix for TROVE-2017-001 and bug 21278. (Note: Instead of handling signed ints "correctly", we keep the old behavior, except for the part where we would crash with -ftrapv.) --- changes/trove-2017-001.2 | 8 ++++++++ src/or/routerparse.c | 49 +++++++++++++++++++++++++++++------------------- 2 files changed, 38 insertions(+), 19 deletions(-) diff --git a/changes/trove-2017-001.2 b/changes/trove-2017-001.2 new file mode 100644 index 0000000..3ef073c --- /dev/null +++ b/changes/trove-2017-001.2 @@ -0,0 +1,8 @@ + o Major bugfixes (parsing): + - Fix an integer underflow bug when comparing malformed Tor versions. + This bug is harmless, except when Tor has been built with + --enable-expensive-hardening, which would turn it into a crash; + or on Tor 0.2.9.1-alpha through Tor 0.2.9.8, which were built with + -ftrapv by default. + Part of TROVE-2017-001. Fixes bug 21278; bugfix on + 0.0.8pre1. Found by OSS-Fuzz. diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 71373ce..1243035 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -4545,26 +4545,37 @@ tor_version_compare(tor_version_t *a, tor_version_t *b) int i; tor_assert(a); tor_assert(b); - if ((i = a->major - b->major)) - return i; - else if ((i = a->minor - b->minor)) - return i; - else if ((i = a->micro - b->micro)) - return i; - else if ((i = a->status - b->status)) - return i; - else if ((i = a->patchlevel - b->patchlevel)) - return i; - else if ((i = strcmp(a->status_tag, b->status_tag))) - return i; - else if ((i = a->svn_revision - b->svn_revision)) - return i; - else if ((i = a->git_tag_len - b->git_tag_len)) - return i; - else if (a->git_tag_len) - return fast_memcmp(a->git_tag, b->git_tag, a->git_tag_len); + + /* We take this approach to comparison to ensure the same (bogus!) behavior + * on all inputs as we would have seen before bug #21278 was fixed. The + * only important difference here is that this method doesn't cause + * a signed integer underflow. + */ +#define CMP(field) do { \ + unsigned aval = (unsigned) a->field; \ + unsigned bval = (unsigned) b->field; \ + int result = (int) (aval - bval); \ + if (result < 0) \ + return -1; \ + else if (result > 0) \ + return 1; \ + } while (0) + + CMP(major); + CMP(minor); + CMP(micro); + CMP(status); + CMP(patchlevel); + if ((i = strcmp(a->status_tag, b->status_tag))) + return i; + CMP(svn_revision); + CMP(git_tag_len); + if (a->git_tag_len) + return fast_memcmp(a->git_tag, b->git_tag, a->git_tag_len); else - return 0; + return 0; + +#undef CMP } /** Return true iff versions a and b belong to the same series.

1 0

[tor/maint-0.2.7] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 15 Feb '17

15 Feb '17

commit a452b713955422e217f7056cf50cb3591830dee9 Merge: 124062e 194e310 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 15 07:47:04 2017 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug20384 | 10 ++++++++++ changes/trove-2017-001.2 | 8 ++++++++ src/or/routerparse.c | 49 +++++++++++++++++++++++++++++------------------- 3 files changed, 48 insertions(+), 19 deletions(-)

1 0

[tor/maint-0.2.7] Avoid integer underflow in tor_version_compare.
by nickm＠torproject.org 15 Feb '17

15 Feb '17

commit 194e31057fbf07d6bdf4b62d26e1a9db334e5f1c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 10:58:02 2017 -0500 Avoid integer underflow in tor_version_compare. Fix for TROVE-2017-001 and bug 21278. (Note: Instead of handling signed ints "correctly", we keep the old behavior, except for the part where we would crash with -ftrapv.) --- changes/trove-2017-001.2 | 8 ++++++++ src/or/routerparse.c | 49 +++++++++++++++++++++++++++++------------------- 2 files changed, 38 insertions(+), 19 deletions(-) diff --git a/changes/trove-2017-001.2 b/changes/trove-2017-001.2 new file mode 100644 index 0000000..3ef073c --- /dev/null +++ b/changes/trove-2017-001.2 @@ -0,0 +1,8 @@ + o Major bugfixes (parsing): + - Fix an integer underflow bug when comparing malformed Tor versions. + This bug is harmless, except when Tor has been built with + --enable-expensive-hardening, which would turn it into a crash; + or on Tor 0.2.9.1-alpha through Tor 0.2.9.8, which were built with + -ftrapv by default. + Part of TROVE-2017-001. Fixes bug 21278; bugfix on + 0.0.8pre1. Found by OSS-Fuzz. diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 71373ce..1243035 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -4545,26 +4545,37 @@ tor_version_compare(tor_version_t *a, tor_version_t *b) int i; tor_assert(a); tor_assert(b); - if ((i = a->major - b->major)) - return i; - else if ((i = a->minor - b->minor)) - return i; - else if ((i = a->micro - b->micro)) - return i; - else if ((i = a->status - b->status)) - return i; - else if ((i = a->patchlevel - b->patchlevel)) - return i; - else if ((i = strcmp(a->status_tag, b->status_tag))) - return i; - else if ((i = a->svn_revision - b->svn_revision)) - return i; - else if ((i = a->git_tag_len - b->git_tag_len)) - return i; - else if (a->git_tag_len) - return fast_memcmp(a->git_tag, b->git_tag, a->git_tag_len); + + /* We take this approach to comparison to ensure the same (bogus!) behavior + * on all inputs as we would have seen before bug #21278 was fixed. The + * only important difference here is that this method doesn't cause + * a signed integer underflow. + */ +#define CMP(field) do { \ + unsigned aval = (unsigned) a->field; \ + unsigned bval = (unsigned) b->field; \ + int result = (int) (aval - bval); \ + if (result < 0) \ + return -1; \ + else if (result > 0) \ + return 1; \ + } while (0) + + CMP(major); + CMP(minor); + CMP(micro); + CMP(status); + CMP(patchlevel); + if ((i = strcmp(a->status_tag, b->status_tag))) + return i; + CMP(svn_revision); + CMP(git_tag_len); + if (a->git_tag_len) + return fast_memcmp(a->git_tag, b->git_tag, a->git_tag_len); else - return 0; + return 0; + +#undef CMP } /** Return true iff versions a and b belong to the same series.

1 0

[tor/maint-0.2.7] Merge branch 'maint-0.2.6' of git-rw.torproject.org:/tor into maint-0.2.6
by nickm＠torproject.org 15 Feb '17

15 Feb '17

commit 6e7ff9ee31c22bf804f711c6595de55ee2f28257 Merge: 3781f24 e778a41 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 15 07:51:41 2017 -0500 Merge branch 'maint-0.2.6' of git-rw.torproject.org:/tor into maint-0.2.6

1 0

[tor/maint-0.2.7] Merge branch 'maint-0.2.6' into maint-0.2.7
by nickm＠torproject.org 15 Feb '17

15 Feb '17

commit ed806843dc8e7942a2a0abfbb2ae374e11963feb Merge: 75fe218 3781f24 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 15 07:47:21 2017 -0500 Merge branch 'maint-0.2.6' into maint-0.2.7 changes/bug20384 | 10 ++++++++++ changes/trove-2017-001.2 | 8 ++++++++ src/or/routerparse.c | 49 +++++++++++++++++++++++++++++------------------- 3 files changed, 48 insertions(+), 19 deletions(-)

1 0