June 2018 - tor-commits - lists.torproject.org

[tor/maint-0.3.4] Fix memory leak in test_sr_setup_commits().
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 8ec6b36dca928057c571af39fd3a9ed599ad5181 Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Jun 23 11:31:59 2018 +0200 Fix memory leak in test_sr_setup_commits(). This patch fixes a memory leak in test_sr_setup_commits() where the place_holder is allocated, but never freed again. See: Coverity CID 1437440. --- src/test/test_shared_random.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/test/test_shared_random.c b/src/test/test_shared_random.c index 056f199b9..5f86d783a 100644 --- a/src/test/test_shared_random.c +++ b/src/test/test_shared_random.c @@ -788,6 +788,7 @@ test_sr_setup_commits(void) tt_assert(!commit_has_reveal_value(commit_d)); done: + tor_free(place_holder); authority_cert_free(auth_cert); }

1 0

[tor/maint-0.3.4] Merge remote-tracking branch 'ahf-github/maint-0.2.9' into maint-0.2.9
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit b426e83f077d57e14fc77ebae18a3637bb2c752a Merge: fcd26af7c 8ec6b36dc Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 29 13:00:52 2018 -0400 Merge remote-tracking branch 'ahf-github/maint-0.2.9' into maint-0.2.9 src/or/routerlist.c | 2 ++ src/or/shared_random_state.c | 1 + src/test/test_hs.c | 7 +++++-- src/test/test_shared_random.c | 1 + 4 files changed, 9 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.3.4] Merge branch 'maint-0.3.1' into maint-0.3.2
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit fe2588a5a8560c8cb03345b3caaaf906655c34a1 Merge: 25226fb26 1385a5118 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 29 13:00:56 2018 -0400 Merge branch 'maint-0.3.1' into maint-0.3.2 src/or/routerlist.c | 2 ++ src/or/shared_random_state.c | 1 + src/test/test_hs.c | 7 +++++-- src/test/test_shared_random.c | 1 + 4 files changed, 9 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.3.4] Merge branch 'maint-0.2.9' into maint-0.3.1
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 1385a5118d55edd3dd672eeb793b662853f30758 Merge: d6d3f8486 b426e83f0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 29 13:00:56 2018 -0400 Merge branch 'maint-0.2.9' into maint-0.3.1 src/or/routerlist.c | 2 ++ src/or/shared_random_state.c | 1 + src/test/test_hs.c | 7 +++++-- src/test/test_shared_random.c | 1 + 4 files changed, 9 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.3.4] Merge branch 'maint-0.3.2' into maint-0.3.3
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit df896ed6323f6f0493393f97e739501df8092e7f Merge: f8dad5a07 fe2588a5a Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 29 13:00:56 2018 -0400 Merge branch 'maint-0.3.2' into maint-0.3.3 src/or/routerlist.c | 2 ++ src/or/shared_random_state.c | 1 + src/test/test_hs.c | 7 +++++-- src/test/test_shared_random.c | 1 + 4 files changed, 9 insertions(+), 2 deletions(-) diff --cc src/or/routerlist.c index 1bfbd9f67,95b39d357..203895c86 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@@ -2758,9 -2755,11 +2758,11 @@@ frac_nodes_with_descriptors(const smart total <= 0.0) { int n_with_descs = 0; SMARTLIST_FOREACH(sl, const node_t *, node, { - if (node_has_descriptor(node)) + if (node_has_any_descriptor(node)) n_with_descs++; }); + + tor_free(bandwidths); return ((double)n_with_descs) / (double)smartlist_len(sl); }

1 0

[tor/maint-0.3.4] Merge branch 'maint-0.3.3' into maint-0.3.4
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 5ab23e03fa0a8bce11798cbf025139e9653b9be4 Merge: c08102ea7 df896ed63 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 29 13:02:56 2018 -0400 Merge branch 'maint-0.3.3' into maint-0.3.4 src/or/dirauth/shared_random_state.c | 1 + src/or/routerlist.c | 2 +- src/test/test_hs.c | 7 +++++-- src/test/test_shared_random.c | 1 + 4 files changed, 8 insertions(+), 3 deletions(-) diff --cc src/or/routerlist.c index 8788dc019,203895c86..97d83213a --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@@ -2764,7 -2761,9 +2764,8 @@@ frac_nodes_with_descriptors(const smart if (node_has_any_descriptor(node)) n_with_descs++; }); - + tor_free(bandwidths); - return ((double)n_with_descs) / (double)smartlist_len(sl); + return ((double)n_with_descs) / smartlist_len(sl); } present = 0.0; @@@ -5819,4 -5818,4 +5820,3 @@@ refresh_all_country_info(void nodelist_refresh_countries(); } --

1 0

[tor/maint-0.3.4] Merge branch 'maint-0.3.3' into maint-0.3.4
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit f6b30a97a96837e012b296a43cc99018d96bcf13 Merge: 5ab23e03f f82f8179e Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 29 13:06:15 2018 -0400 Merge branch 'maint-0.3.3' into maint-0.3.4 changes/ticket26467 | 3 +++ src/or/directory.c | 1 + src/or/hs_descriptor.c | 1 + src/test/hs_test_helpers.c | 6 ++++++ src/test/test_channelpadding.c | 2 ++ src/test/test_hs_descriptor.c | 11 +++++------ 6 files changed, 18 insertions(+), 6 deletions(-)

1 0

[tor/maint-0.3.4] Changes file for 26467
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 890bc15ab641f1c22a39b9a86de656a4e3a2d225 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 29 13:04:29 2018 -0400 Changes file for 26467 --- changes/ticket26467 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/changes/ticket26467 b/changes/ticket26467 new file mode 100644 index 000000000..45883786c --- /dev/null +++ b/changes/ticket26467 @@ -0,0 +1,3 @@ + o Minor bugfixes (memory, correctness): + - Fix a number of small memory leaks identified by coverity. Fixes + bug 26467; bugfix on numerous Tor versions.

1 0

[tor/maint-0.3.4] Merge branch 'maint-0.3.1' into maint-0.3.2
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 68dfbd5ef433b830059baa08d48589518db05d22 Merge: fe2588a5a ea14d3408 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 29 13:06:15 2018 -0400 Merge branch 'maint-0.3.1' into maint-0.3.2 changes/ticket26467 | 3 +++ src/or/directory.c | 1 + src/or/hs_descriptor.c | 1 + src/test/hs_test_helpers.c | 6 ++++++ src/test/test_channelpadding.c | 2 ++ src/test/test_hs_descriptor.c | 11 +++++------ 6 files changed, 18 insertions(+), 6 deletions(-) diff --cc src/or/hs_descriptor.c index fef0607c1,8e10c0fff..582ac9cb7 --- a/src/or/hs_descriptor.c +++ b/src/or/hs_descriptor.c @@@ -1115,16 -1133,8 +1115,17 @@@ decode_link_specifiers(const char *enco memcpy(hs_spec->u.legacy_id, link_specifier_getarray_un_legacy_id(ls), sizeof(hs_spec->u.legacy_id)); break; + case LS_ED25519_ID: + /* Both are known at compile time so let's make sure they are the same + * else we can copy memory out of bound. */ + tor_assert(link_specifier_getlen_un_ed25519_id(ls) == + sizeof(hs_spec->u.ed25519_id)); + memcpy(hs_spec->u.ed25519_id, + link_specifier_getconstarray_un_ed25519_id(ls), + sizeof(hs_spec->u.ed25519_id)); + break; default: + tor_free(hs_spec); goto err; }

1 0

[tor/master] Fix potential memory leak in hs_helper_build_intro_point().
by nickm＠torproject.org 29 Jun '18

29 Jun '18

commit 8c8941eb297a166aa7b1b915a543bf97b3a63039 Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Jun 23 00:44:33 2018 +0200 Fix potential memory leak in hs_helper_build_intro_point(). This patch fixes a potential memory leak in hs_helper_build_intro_point() where a `goto done` is called before the `intro_point` variable have been assigned to the value of the `ip` variable. See: Coverity CID 1437460 See: Coverity CID 1437456 --- src/test/hs_test_helpers.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/test/hs_test_helpers.c b/src/test/hs_test_helpers.c index 3f0d6a941..f7e054b1d 100644 --- a/src/test/hs_test_helpers.c +++ b/src/test/hs_test_helpers.c @@ -85,6 +85,9 @@ hs_helper_build_intro_point(const ed25519_keypair_t *signing_kp, time_t now, intro_point = ip; done: + if (intro_point == NULL) + tor_free(ip); + return intro_point; }

1 0