May 2017 - tor-commits - lists.torproject.org

[tor/master] don't free the values in options->MyFamily when we make a descriptor
by nickm＠torproject.org 25 May '17

25 May '17

commit a7e75ff7966d7d3d83d41a47c5b9fa5e3daa2465 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed May 24 23:14:23 2017 -0400 don't free the values in options->MyFamily when we make a descriptor If we free them here, we will still attempt to access the freed memory later on, and also we will double-free when we are freeing the config. Fixes part of bug 22368. --- src/or/router.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/or/router.c b/src/or/router.c index 642f415..b43742a 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -2289,7 +2289,7 @@ router_build_fresh_descriptor(routerinfo_t **r, extrainfo_t **e) char *name = family->value; const node_t *member; if (!strcasecmp(name, options->Nickname)) - goto skip; /* Don't list ourself, that's redundant */ + continue; /* Don't list ourself, that's redundant */ else member = node_get_by_nickname(name, 1); if (!member) { @@ -2323,8 +2323,6 @@ router_build_fresh_descriptor(routerinfo_t **r, extrainfo_t **e) if (smartlist_contains_string(warned_nonexistent_family, name)) smartlist_string_remove(warned_nonexistent_family, name); } - skip: - tor_free(name); } /* remove duplicates from the list */

1 0

[tor/master] add copy of MyFamily element to the descriptor, not the element itself
by nickm＠torproject.org 25 May '17

25 May '17

commit d22d565331c7f8e02abb7720afd447c6b8760f21 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed May 24 23:23:12 2017 -0400 add copy of MyFamily element to the descriptor, not the element itself If we add the element itself, we will later free it when we free the descriptor, and the next time we go to look at MyFamily, things will go badly. Fixes the rest of bug 22368; bugfix on 0.3.1.1-alpha. --- changes/bug22368 | 6 ++++++ src/or/router.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/bug22368 b/changes/bug22368 new file mode 100644 index 0000000..eb445d0 --- /dev/null +++ b/changes/bug22368 @@ -0,0 +1,6 @@ + o Major bugfixes: + - Relays that set MyFamily no longer free the elements of + options->MyFamily while making their descriptor. They tried to + access the freed elements, and then double-free them, when making + the next descriptor or when changing the config. Fixes bug 22368; + bugfix on 0.3.1.1-alpha. diff --git a/src/or/router.c b/src/or/router.c index b43742a..f2741b7 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -2308,7 +2308,7 @@ router_build_fresh_descriptor(routerinfo_t **r, extrainfo_t **e) smartlist_add_strdup(warned_nonexistent_family, name); } if (is_legal) { - smartlist_add(ri->declared_family, name); + smartlist_add_strdup(ri->declared_family, name); name = NULL; } } else if (router_digest_is_me(member->identity)) {

1 0

[tor/master] Merge branch 'maint-0.2.9' into maint-0.3.0
by arma＠torproject.org 25 May '17

25 May '17

commit 83439e78cc08f5a05d314de4409e69aa6d1601d7 Merge: 5c52d3c ec61ae5 Author: Roger Dingledine <arma(a)torproject.org> Date: Thu May 25 00:27:27 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/bug22370 | 4 ++++ src/or/dirserv.c | 7 ++++++- 2 files changed, 10 insertions(+), 1 deletion(-)

1 0

[tor/master] Stop leaking keypin-rejected routerinfos on directory authorities
by arma＠torproject.org 25 May '17

25 May '17

commit ec61ae59a5d009a9e80f3bfa9a2aa5f5dfa05551 Author: teor <teor2345(a)gmail.com> Date: Thu May 25 12:30:21 2017 +1000 Stop leaking keypin-rejected routerinfos on directory authorities When directory authorities reject a router descriptor due to keypinning, free the router descriptor rather than leaking the memory. Fixes bug 22370; bugfix on 0.2.7.2-alpha. --- changes/bug22370 | 4 ++++ src/or/dirserv.c | 7 ++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/changes/bug22370 b/changes/bug22370 new file mode 100644 index 0000000..e0e87e3 --- /dev/null +++ b/changes/bug22370 @@ -0,0 +1,4 @@ + o Minor bugfixes (memory handling): + - When directory authorities reject a router descriptor due to keypinning, + free the router descriptor rather than leaking the memory. + Fixes bug 22370; bugfix on 0.2.7.2-alpha. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index fedbe51..7244108 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -626,7 +626,11 @@ dirserv_add_multiple_descriptors(const char *desc, uint8_t purpose, * passed back to the origin of this descriptor, or NULL if there is no such * message. Use source to produce better log messages. * - * Return the status of the operation + * If ri is not added to the list of server descriptors, free it. + * That means the caller must not access ri after this function + * returns, since it might have been freed. + * + * Return the status of the operation. * * This function is only called when fresh descriptors are posted, not when * we re-load the cache. @@ -699,6 +703,7 @@ dirserv_add_descriptor(routerinfo_t *ri, const char **msg, const char *source) "its key did not match an older RSA/Ed25519 keypair", router_describe(ri), source); *msg = "Looks like your keypair does not match its older value."; + routerinfo_free(ri); return ROUTER_AUTHDIR_REJECTS; }

1 0

[tor/master] Merge branch 'maint-0.3.0'
by arma＠torproject.org 25 May '17

25 May '17

commit 657297a9f8bedfab2dadfaee53768a1f9b8a558e Merge: 511c900 83439e7 Author: Roger Dingledine <arma(a)torproject.org> Date: Thu May 25 00:28:11 2017 -0400 Merge branch 'maint-0.3.0' changes/bug22370 | 4 ++++ src/or/dirserv.c | 7 ++++++- 2 files changed, 10 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.0] Merge branch 'maint-0.2.9' into maint-0.3.0
by arma＠torproject.org 25 May '17

25 May '17

commit 83439e78cc08f5a05d314de4409e69aa6d1601d7 Merge: 5c52d3c ec61ae5 Author: Roger Dingledine <arma(a)torproject.org> Date: Thu May 25 00:27:27 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/bug22370 | 4 ++++ src/or/dirserv.c | 7 ++++++- 2 files changed, 10 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.0] Merge branch 'maint-0.3.0' into release-0.3.0
by arma＠torproject.org 25 May '17

25 May '17

commit 384457912f771d39b98690c25aeea3e541dbfb28 Merge: 94b5128 83439e7 Author: Roger Dingledine <arma(a)torproject.org> Date: Thu May 25 00:27:47 2017 -0400 Merge branch 'maint-0.3.0' into release-0.3.0 changes/bug22370 | 4 ++++ src/or/dirserv.c | 7 ++++++- 2 files changed, 10 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.0] Stop leaking keypin-rejected routerinfos on directory authorities
by arma＠torproject.org 25 May '17

25 May '17

commit ec61ae59a5d009a9e80f3bfa9a2aa5f5dfa05551 Author: teor <teor2345(a)gmail.com> Date: Thu May 25 12:30:21 2017 +1000 Stop leaking keypin-rejected routerinfos on directory authorities When directory authorities reject a router descriptor due to keypinning, free the router descriptor rather than leaking the memory. Fixes bug 22370; bugfix on 0.2.7.2-alpha. --- changes/bug22370 | 4 ++++ src/or/dirserv.c | 7 ++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/changes/bug22370 b/changes/bug22370 new file mode 100644 index 0000000..e0e87e3 --- /dev/null +++ b/changes/bug22370 @@ -0,0 +1,4 @@ + o Minor bugfixes (memory handling): + - When directory authorities reject a router descriptor due to keypinning, + free the router descriptor rather than leaking the memory. + Fixes bug 22370; bugfix on 0.2.7.2-alpha. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index fedbe51..7244108 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -626,7 +626,11 @@ dirserv_add_multiple_descriptors(const char *desc, uint8_t purpose, * passed back to the origin of this descriptor, or NULL if there is no such * message. Use source to produce better log messages. * - * Return the status of the operation + * If ri is not added to the list of server descriptors, free it. + * That means the caller must not access ri after this function + * returns, since it might have been freed. + * + * Return the status of the operation. * * This function is only called when fresh descriptors are posted, not when * we re-load the cache. @@ -699,6 +703,7 @@ dirserv_add_descriptor(routerinfo_t *ri, const char **msg, const char *source) "its key did not match an older RSA/Ed25519 keypair", router_describe(ri), source); *msg = "Looks like your keypair does not match its older value."; + routerinfo_free(ri); return ROUTER_AUTHDIR_REJECTS; }

1 0

[tor/maint-0.3.0] Stop leaking keypin-rejected routerinfos on directory authorities
by arma＠torproject.org 25 May '17

25 May '17

commit ec61ae59a5d009a9e80f3bfa9a2aa5f5dfa05551 Author: teor <teor2345(a)gmail.com> Date: Thu May 25 12:30:21 2017 +1000 Stop leaking keypin-rejected routerinfos on directory authorities When directory authorities reject a router descriptor due to keypinning, free the router descriptor rather than leaking the memory. Fixes bug 22370; bugfix on 0.2.7.2-alpha. --- changes/bug22370 | 4 ++++ src/or/dirserv.c | 7 ++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/changes/bug22370 b/changes/bug22370 new file mode 100644 index 0000000..e0e87e3 --- /dev/null +++ b/changes/bug22370 @@ -0,0 +1,4 @@ + o Minor bugfixes (memory handling): + - When directory authorities reject a router descriptor due to keypinning, + free the router descriptor rather than leaking the memory. + Fixes bug 22370; bugfix on 0.2.7.2-alpha. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index fedbe51..7244108 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -626,7 +626,11 @@ dirserv_add_multiple_descriptors(const char *desc, uint8_t purpose, * passed back to the origin of this descriptor, or NULL if there is no such * message. Use source to produce better log messages. * - * Return the status of the operation + * If ri is not added to the list of server descriptors, free it. + * That means the caller must not access ri after this function + * returns, since it might have been freed. + * + * Return the status of the operation. * * This function is only called when fresh descriptors are posted, not when * we re-load the cache. @@ -699,6 +703,7 @@ dirserv_add_descriptor(routerinfo_t *ri, const char **msg, const char *source) "its key did not match an older RSA/Ed25519 keypair", router_describe(ri), source); *msg = "Looks like your keypair does not match its older value."; + routerinfo_free(ri); return ROUTER_AUTHDIR_REJECTS; }

1 0

[tor/maint-0.3.0] Merge branch 'maint-0.2.9' into maint-0.3.0
by arma＠torproject.org 25 May '17

25 May '17

commit 83439e78cc08f5a05d314de4409e69aa6d1601d7 Merge: 5c52d3c ec61ae5 Author: Roger Dingledine <arma(a)torproject.org> Date: Thu May 25 00:27:27 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/bug22370 | 4 ++++ src/or/dirserv.c | 7 ++++++- 2 files changed, 10 insertions(+), 1 deletion(-)

1 0