June 2018 - tor-commits - lists.torproject.org

[tor/release-0.3.3] Fix potential memory leak in hs_helper_build_intro_point().
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 8c8941eb297a166aa7b1b915a543bf97b3a63039 Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Jun 23 00:44:33 2018 +0200 Fix potential memory leak in hs_helper_build_intro_point(). This patch fixes a potential memory leak in hs_helper_build_intro_point() where a `goto done` is called before the `intro_point` variable have been assigned to the value of the `ip` variable. See: Coverity CID 1437460 See: Coverity CID 1437456 --- src/test/hs_test_helpers.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/test/hs_test_helpers.c b/src/test/hs_test_helpers.c index 3f0d6a941..f7e054b1d 100644 --- a/src/test/hs_test_helpers.c +++ b/src/test/hs_test_helpers.c @@ -85,6 +85,9 @@ hs_helper_build_intro_point(const ed25519_keypair_t *signing_kp, time_t now, intro_point = ip; done: + if (intro_point == NULL) + tor_free(ip); + return intro_point; }

1 0

[tor/release-0.3.2] Merge branch 'maint-0.3.1' into maint-0.3.2
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 68dfbd5ef433b830059baa08d48589518db05d22 Merge: fe2588a5a ea14d3408 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 29 13:06:15 2018 -0400 Merge branch 'maint-0.3.1' into maint-0.3.2 changes/ticket26467 | 3 +++ src/or/directory.c | 1 + src/or/hs_descriptor.c | 1 + src/test/hs_test_helpers.c | 6 ++++++ src/test/test_channelpadding.c | 2 ++ src/test/test_hs_descriptor.c | 11 +++++------ 6 files changed, 18 insertions(+), 6 deletions(-) diff --cc src/or/hs_descriptor.c index fef0607c1,8e10c0fff..582ac9cb7 --- a/src/or/hs_descriptor.c +++ b/src/or/hs_descriptor.c @@@ -1115,16 -1133,8 +1115,17 @@@ decode_link_specifiers(const char *enco memcpy(hs_spec->u.legacy_id, link_specifier_getarray_un_legacy_id(ls), sizeof(hs_spec->u.legacy_id)); break; + case LS_ED25519_ID: + /* Both are known at compile time so let's make sure they are the same + * else we can copy memory out of bound. */ + tor_assert(link_specifier_getlen_un_ed25519_id(ls) == + sizeof(hs_spec->u.ed25519_id)); + memcpy(hs_spec->u.ed25519_id, + link_specifier_getconstarray_un_ed25519_id(ls), + sizeof(hs_spec->u.ed25519_id)); + break; default: + tor_free(hs_spec); goto err; }

1 0

[tor/release-0.3.3] Fix potential memory leak in hs_helper_build_hs_desc_impl().
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit dc2384da30cae716f512dedef37d27f00c43f29d Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Jun 23 10:27:10 2018 +0200 Fix potential memory leak in hs_helper_build_hs_desc_impl(). This patch fixes a memory leak in hs_helper_build_hs_desc_impl() where if a test assertion would fail we would leak the storage that `desc` points to. See: Coverity CID 1437448 --- src/test/hs_test_helpers.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/test/hs_test_helpers.c b/src/test/hs_test_helpers.c index f7e054b1d..dcd58bc5f 100644 --- a/src/test/hs_test_helpers.c +++ b/src/test/hs_test_helpers.c @@ -142,6 +142,9 @@ hs_helper_build_hs_desc_impl(unsigned int no_ip, descp = desc; done: + if (descp == NULL) + tor_free(desc); + return descp; }

1 0

[tor/release-0.3.3] Fix memory leak in decode_link_specifiers().
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 3d80c086bea3b0d93327c30ac620740b629cb294 Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Jun 23 11:54:36 2018 +0200 Fix memory leak in decode_link_specifiers(). This patch fixes a memory leak in decode_link_specifiers() where the hs_spec variable might leak if the default label is taken in the switch/case expression. See: Coverity CID 1437437. --- src/or/hs_descriptor.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/or/hs_descriptor.c b/src/or/hs_descriptor.c index 938b7a77d..15bdd14d5 100644 --- a/src/or/hs_descriptor.c +++ b/src/or/hs_descriptor.c @@ -864,6 +864,7 @@ decode_link_specifiers(const char *encoded) sizeof(hs_spec->u.legacy_id)); break; default: + tor_free(hs_spec); goto err; }

1 0

[tor/release-0.3.3] Fix memory leak in client_likes_consensus().
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit d86c45bf5cc75a526b884a754d72ef4d11aa0693 Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Jun 23 10:33:40 2018 +0200 Fix memory leak in client_likes_consensus(). This patches fixes a memory leak in client_likes_consensus() where if consensus_cache_entry_get_voter_id_digests() would fail we would return without having free'd the voters list. See: Coverity CID 1437447 --- src/or/directory.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/or/directory.c b/src/or/directory.c index 5ceea2fb3..f52354356 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -3499,6 +3499,7 @@ client_likes_consensus(const struct consensus_cache_entry_t *ent, int have = 0; if (consensus_cache_entry_get_voter_id_digests(ent, voters) != 0) { + smartlist_free(voters); return 1; // We don't know the voters; assume the client won't mind. */ }

1 0

[tor/release-0.3.3] Fix memory leak in test_sr_setup_commits().
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 8ec6b36dca928057c571af39fd3a9ed599ad5181 Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Jun 23 11:31:59 2018 +0200 Fix memory leak in test_sr_setup_commits(). This patch fixes a memory leak in test_sr_setup_commits() where the place_holder is allocated, but never freed again. See: Coverity CID 1437440. --- src/test/test_shared_random.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/test/test_shared_random.c b/src/test/test_shared_random.c index 056f199b9..5f86d783a 100644 --- a/src/test/test_shared_random.c +++ b/src/test/test_shared_random.c @@ -788,6 +788,7 @@ test_sr_setup_commits(void) tt_assert(!commit_has_reveal_value(commit_d)); done: + tor_free(place_holder); authority_cert_free(auth_cert); }

1 0

[tor/release-0.3.3] Fix memory leak in disk_state_parse_commits().
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 3395de51a01aa5519c52404ed2bb9c8cda3571c9 Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Jun 23 11:28:00 2018 +0200 Fix memory leak in disk_state_parse_commits(). This patch fixes a memory leak in disk_state_parse_commits() where if commit is NULL, we continue the internal loop, but without ever freeing the args variable. See: Coverity CID 1437441. --- src/or/shared_random_state.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/or/shared_random_state.c b/src/or/shared_random_state.c index 87db9031e..8438d4640 100644 --- a/src/or/shared_random_state.c +++ b/src/or/shared_random_state.c @@ -409,6 +409,7 @@ disk_state_parse_commits(sr_state_t *state, if (commit == NULL) { /* Ignore badly formed commit. It could also be a authority * fingerprint that we don't know about so it shouldn't be used. */ + smartlist_free(args); continue; } /* We consider parseable commit from our disk state to be valid because

1 0

[tor/release-0.3.3] Fix memory leak in frac_nodes_with_descriptors().
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit dcbfee246f35970f65d08a4555e25b956b9aba9c Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Jun 23 03:24:10 2018 +0200 Fix memory leak in frac_nodes_with_descriptors(). This patch fixes a memory leak in frac_nodes_with_descriptors() where we might return without free'ing the bandwidths variable. See: Coverity CID 1437451. --- src/or/routerlist.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index f21a222cd..f73ec9baa 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -2765,6 +2765,8 @@ frac_nodes_with_descriptors(const smartlist_t *sl, if (node_has_descriptor(node)) n_with_descs++; }); + + tor_free(bandwidths); return ((double)n_with_descs) / (double)smartlist_len(sl); }

1 0

[tor/release-0.3.3] Fix memory link in test_link_specifier().
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit c997d49ad6e6a360323311444eed1dbee785aea4 Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Jun 23 12:39:20 2018 +0200 Fix memory link in test_link_specifier(). This patch fixes a memory leak in test_link_specifier() where ls might not get freed in case one of the test macros fails. See: Coverity CID 1437434. --- src/test/test_hs_descriptor.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/src/test/test_hs_descriptor.c b/src/test/test_hs_descriptor.c index 97fe1910b..365683e75 100644 --- a/src/test/test_hs_descriptor.c +++ b/src/test/test_hs_descriptor.c @@ -376,6 +376,9 @@ test_link_specifier(void *arg) ssize_t ret; hs_desc_link_specifier_t spec; smartlist_t *link_specifiers = smartlist_new(); + char buf[256]; + char *b64 = NULL; + link_specifier_t *ls = NULL; (void) arg; @@ -385,9 +388,7 @@ test_link_specifier(void *arg) /* Test IPv4 for starter. */ { - char *b64, buf[256]; uint32_t ipv4; - link_specifier_t *ls; spec.type = LS_IPV4; ret = tor_addr_parse(&spec.u.ap.addr, "1.2.3.4"); @@ -414,9 +415,7 @@ test_link_specifier(void *arg) /* Test IPv6. */ { - char *b64, buf[256]; uint8_t ipv6[16]; - link_specifier_t *ls; spec.type = LS_IPV6; ret = tor_addr_parse(&spec.u.ap.addr, "[1:2:3:4::]"); @@ -445,9 +444,7 @@ test_link_specifier(void *arg) /* Test legacy. */ { - char *b64, buf[256]; uint8_t *id; - link_specifier_t *ls; spec.type = LS_LEGACY_ID; memset(spec.u.legacy_id, 'Y', sizeof(spec.u.legacy_id)); @@ -473,6 +470,8 @@ test_link_specifier(void *arg) } done: + link_specifier_free(ls); + tor_free(b64); smartlist_free(link_specifiers); }

1 0

[tor/release-0.3.3] Fix memory leak in test_channelpadding_consensus().
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 8550016e6f5e2780259f5073e34e67708e4e87ff Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Jun 23 12:52:04 2018 +0200 Fix memory leak in test_channelpadding_consensus(). The relay variable is always allocated, but might not be freed before we return from this function. See: Coverity CID 1437431 --- src/test/test_channelpadding.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/test/test_channelpadding.c b/src/test/test_channelpadding.c index d54c9cc52..0bc9699fe 100644 --- a/src/test/test_channelpadding.c +++ b/src/test/test_channelpadding.c @@ -745,6 +745,8 @@ test_channelpadding_consensus(void *arg) tt_i64_op(val, OP_LE, 24*60*60*2); done: + tor_free(relay); + free_mock_consensus(); free_fake_channeltls((channel_tls_t*)chan); smartlist_free(connection_array);

1 0