May 2019 - tor-commits - lists.torproject.org

[tor/master] Fixed tor_vasprintf on systems without vasprintf.
by dgoulet＠torproject.org 30 May '19

30 May '19

commit 0d5a0b4f0ccc804913fbca20acf5fc62f52570b8 Author: Tobias Stoeckmann <tobias(a)stoeckmann.org> Date: Wed May 29 09:33:24 2019 -0400 Fixed tor_vasprintf on systems without vasprintf. If tor is compiled on a system with neither vasprintf nor _vscprintf, the fallback implementation exposes a logic flaw which prevents proper usage of strings longer than 127 characters: * tor_vsnprintf returns -1 if supplied buffer is not large enough, but tor_vasprintf uses this function to retrieve required length * the result of tor_vsnprintf is not properly checked for negative return values Both aspects together could in theory lead to exposure of uninitialized stack memory in the resulting string. This requires an invalid format string or data that exceeds integer limitations. Fortunately tor is not even able to run with this implementation because it runs into asserts early on during startup. Also the unit tests fail during a "make check" run. Signed-off-by: Tobias Stoeckmann <tobias(a)stoeckmann.org> [backported to 0.2.9 by nickm] --- src/common/compat.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/common/compat.c b/src/common/compat.c index 975875112..d3bc2f5fe 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -558,10 +558,17 @@ tor_vasprintf(char **strp, const char *fmt, va_list args) int len, r; va_list tmp_args; va_copy(tmp_args, args); - /* vsnprintf() was properly checked but tor_vsnprintf() available so - * why not use it? */ - len = tor_vsnprintf(buf, sizeof(buf), fmt, tmp_args); + /* Use vsnprintf to retrieve needed length. tor_vsnprintf() is not an option + * here because it will simply return -1 if buf is not large enough to hold the + * complete string. + */ + len = vsnprintf(buf, sizeof(buf), fmt, tmp_args); va_end(tmp_args); + buf[sizeof(buf) - 1] = '\0'; + if (len < 0) { + *strp = NULL; + return -1; + } if (len < (int)sizeof(buf)) { *strp = tor_strdup(buf); return len;

1 0

[tor/master] Tweak comments in tor_vasprintf(), and add a changes file for 30651
by dgoulet＠torproject.org 30 May '19

30 May '19

commit 0e0cf4abd80249faa23f2bbdb89e62ba96c898f0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 29 09:38:32 2019 -0400 Tweak comments in tor_vasprintf(), and add a changes file for 30651 --- changes/bug30561 | 6 ++++++ src/common/compat.c | 10 ++++++---- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/changes/bug30561 b/changes/bug30561 new file mode 100644 index 000000000..afb3f02c6 --- /dev/null +++ b/changes/bug30561 @@ -0,0 +1,6 @@ + o Minor bugfixes (portability): + - Avoid crashing in our tor_vasprintf() implementation on systems that + define neither vasprintf() nor _vscprintf(). (This bug has been here + long enough that we question whether people are running Tor on such + systems, but we're applying the fix out of caution.) Fixes bug 30561; + bugfix on 0.2.8.2-alpha. Found and fixed by Tobias Stoeckmann. diff --git a/src/common/compat.c b/src/common/compat.c index d3bc2f5fe..ee3bf0fd5 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -554,13 +554,16 @@ tor_vasprintf(char **strp, const char *fmt, va_list args) * characters we need. We give it a try on a short buffer first, since * it might be nice to avoid the second vsnprintf call. */ + /* XXXX This code spent a number of years broken (see bug 30651). It is + * possible that no Tor users actually run on systems without vasprintf() or + * _vscprintf(). If so, we should consider removing this code. */ char buf[128]; int len, r; va_list tmp_args; va_copy(tmp_args, args); - /* Use vsnprintf to retrieve needed length. tor_vsnprintf() is not an option - * here because it will simply return -1 if buf is not large enough to hold the - * complete string. + /* Use vsnprintf to retrieve needed length. tor_vsnprintf() is not an + * option here because it will simply return -1 if buf is not large enough + * to hold the complete string. */ len = vsnprintf(buf, sizeof(buf), fmt, tmp_args); va_end(tmp_args); @@ -3550,4 +3553,3 @@ tor_get_avail_disk_space(const char *path) return -1; #endif } -

1 0

[tor/master] Merge branch 'tor-github/pr/1054'
by dgoulet＠torproject.org 30 May '19

30 May '19

commit ef9170db4cc936c7154d8be7626f9c57f75c0049 Merge: 61bd8f428 8f0b29961 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu May 30 09:59:21 2019 -0400 Merge branch 'tor-github/pr/1054' changes/bug30561 | 6 ++++++ src/lib/string/printf.c | 16 +++++++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-)

1 0

[tor/master] Merge branch 'ticket30561_029' into ticket30561_035
by dgoulet＠torproject.org 30 May '19

30 May '19

commit 8f0b29961eb4b9965f22bbcabdc0aa0354c19a4a Merge: e5deb2bbc 0e0cf4abd Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 29 09:43:20 2019 -0400 Merge branch 'ticket30561_029' into ticket30561_035 changes/bug30561 | 6 ++++++ src/lib/string/printf.c | 16 +++++++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-) diff --cc src/lib/string/printf.c index 415d4ac4a,000000000..a5cb71ce0 mode 100644,000000..100644 --- a/src/lib/string/printf.c +++ b/src/lib/string/printf.c @@@ -1,157 -1,0 +1,167 @@@ +/* Copyright (c) 2003-2004, Roger Dingledine + * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. + * Copyright (c) 2007-2019, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * \file printf.c + * \brief Compatibility wrappers around snprintf and its friends + **/ + +#include "lib/string/printf.h" +#include "lib/err/torerr.h" +#include "lib/cc/torint.h" +#include "lib/malloc/malloc.h" + +#include <stdlib.h> +#include <stdio.h> + +/** Replacement for snprintf. Differs from platform snprintf in two + * ways: First, always NUL-terminates its output. Second, always + * returns -1 if the result is truncated. (Note that this return + * behavior does <i>not</i> conform to C99; it just happens to be + * easier to emulate "return -1" with conformant implementations than + * it is to emulate "return number that would be written" with + * non-conformant implementations.) */ +int +tor_snprintf(char *str, size_t size, const char *format, ...) +{ + va_list ap; + int r; + va_start(ap,format); + r = tor_vsnprintf(str,size,format,ap); + va_end(ap); + return r; +} + +/** Replacement for vsnprintf; behavior differs as tor_snprintf differs from + * snprintf. + */ +int +tor_vsnprintf(char *str, size_t size, const char *format, va_list args) +{ + int r; + if (size == 0) + return -1; /* no place for the NUL */ + if (size > SIZE_T_CEILING) + return -1; +#ifdef _WIN32 + r = _vsnprintf(str, size, format, args); +#else + r = vsnprintf(str, size, format, args); +#endif + str[size-1] = '\0'; + if (r < 0 || r >= (ssize_t)size) + return -1; + return r; +} + +/** + * Portable asprintf implementation. Does a printf() into a newly malloc'd + * string. Sets *<b>strp</b> to this string, and returns its length (not + * including the terminating NUL character). + * + * You can treat this function as if its implementation were something like + <pre> + char buf[_INFINITY_]; + tor_snprintf(buf, sizeof(buf), fmt, args); + *strp = tor_strdup(buf); + return strlen(*strp): + </pre> + * Where _INFINITY_ is an imaginary constant so big that any string can fit + * into it. + */ +int +tor_asprintf(char **strp, const char *fmt, ...) +{ + int r; + va_list args; + va_start(args, fmt); + r = tor_vasprintf(strp, fmt, args); + va_end(args); + if (!*strp || r < 0) { + /* LCOV_EXCL_START */ + raw_assert_unreached_msg("Internal error in asprintf"); + /* LCOV_EXCL_STOP */ + } + return r; +} + +/** + * Portable vasprintf implementation. Does a printf() into a newly malloc'd + * string. Differs from regular vasprintf in the same ways that + * tor_asprintf() differs from regular asprintf. + */ +int +tor_vasprintf(char **strp, const char *fmt, va_list args) +{ + /* use a temporary variable in case *strp is in args. */ + char *strp_tmp=NULL; +#ifdef HAVE_VASPRINTF + /* If the platform gives us one, use it. */ + int r = vasprintf(&strp_tmp, fmt, args); + if (r < 0) + *strp = NULL; // LCOV_EXCL_LINE -- no cross-platform way to force this + else + *strp = strp_tmp; + return r; +#elif defined(HAVE__VSCPRINTF) + /* On Windows, _vsnprintf won't tell us the length of the string if it + * overflows, so we need to use _vcsprintf to tell how much to allocate */ + int len, r; + va_list tmp_args; + va_copy(tmp_args, args); + len = _vscprintf(fmt, tmp_args); + va_end(tmp_args); + if (len < 0) { + *strp = NULL; + return -1; + } + strp_tmp = tor_malloc(len + 1); + r = _vsnprintf(strp_tmp, len+1, fmt, args); + if (r != len) { + tor_free(strp_tmp); + *strp = NULL; + return -1; + } + *strp = strp_tmp; + return len; +#else + /* Everywhere else, we have a decent vsnprintf that tells us how many + * characters we need. We give it a try on a short buffer first, since + * it might be nice to avoid the second vsnprintf call. + */ ++ /* XXXX This code spent a number of years broken (see bug 30651). It is ++ * possible that no Tor users actually run on systems without vasprintf() or ++ * _vscprintf(). If so, we should consider removing this code. */ + char buf[128]; + int len, r; + va_list tmp_args; + va_copy(tmp_args, args); - /* vsnprintf() was properly checked but tor_vsnprintf() available so - * why not use it? */ - len = tor_vsnprintf(buf, sizeof(buf), fmt, tmp_args); ++ /* Use vsnprintf to retrieve needed length. tor_vsnprintf() is not an ++ * option here because it will simply return -1 if buf is not large enough ++ * to hold the complete string. ++ */ ++ len = vsnprintf(buf, sizeof(buf), fmt, tmp_args); + va_end(tmp_args); ++ buf[sizeof(buf) - 1] = '\0'; ++ if (len < 0) { ++ *strp = NULL; ++ return -1; ++ } + if (len < (int)sizeof(buf)) { + *strp = tor_strdup(buf); + return len; + } + strp_tmp = tor_malloc(len+1); + /* use of tor_vsnprintf() will ensure string is null terminated */ + r = tor_vsnprintf(strp_tmp, len+1, fmt, args); + if (r != len) { + tor_free(strp_tmp); + *strp = NULL; + return -1; + } + *strp = strp_tmp; + return len; +#endif /* defined(HAVE_VASPRINTF) || ... */ +}

1 0

[tor/master] Changes file for bug 30614
by dgoulet＠torproject.org 30 May '19

30 May '19

commit bdf685e47614ef5dca935b9fe9a608ffdd63a816 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 29 09:05:26 2019 -0400 Changes file for bug 30614 --- changes/bug30614 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/bug30614 b/changes/bug30614 new file mode 100644 index 000000000..9f904bd11 --- /dev/null +++ b/changes/bug30614 @@ -0,0 +1,4 @@ + o Minor bugfixes (NetBSD): + - Fix usage of minherit() on NetBSD and other platforms that define + MAP_INHERIT_{ZERO,NONE} instead of INHERIT_{ZERO,NONE}. Fixes bug + 30614; bugfix on 0.4.0.2-alpha. Patch from Taylor Campbell.

1 0

[tor/master] Use MAP_INHERIT_ZERO or MAP_INHERIT_NONE if available.
by dgoulet＠torproject.org 30 May '19

30 May '19

commit 7971b3a5a6fc8b964339b144ae33faf9db1c3869 Author: Taylor R Campbell <campbell+tor(a)mumble.net> Date: Sat May 25 03:55:24 2019 +0000 Use MAP_INHERIT_ZERO or MAP_INHERIT_NONE if available. Fixes assertion failure in tests on NetBSD: slow/prob_distr/stochastic_log_logistic: [forking] May 25 03:56:58.091 [err] tor_assertion_failed_(): Bug: src/lib/crypt_ops/crypto_rand_fast.c:184: crypto_fast_rng_new_from_seed: Assertion inherit != INHERIT_RES_KEEP failed; aborting. (on Tor 0.4.1.1-alpha-dev 29955f13e5bc8e61) May 25 03:56:58.091 [err] Bug: Assertion inherit != INHERIT_RES_KEEP failed in crypto_fast_rng_new_from_seed at src/lib/crypt_ops/crypto_rand_fast.c:184: . (Stack trace not available) (on Tor 0.4.1.1-alpha-dev 29955f13e5bc8e61) [Lost connection!] --- src/lib/malloc/map_anon.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/lib/malloc/map_anon.c b/src/lib/malloc/map_anon.c index 2fc6e89ea..2430f7ad1 100644 --- a/src/lib/malloc/map_anon.c +++ b/src/lib/malloc/map_anon.c @@ -50,11 +50,15 @@ #ifdef INHERIT_ZERO #define FLAG_ZERO INHERIT_ZERO +#elif defined(MAP_INHERIT_ZERO) +#define FLAG_ZERO MAP_INHERIT_ZERO #endif #ifdef INHERIT_NONE #define FLAG_NOINHERIT INHERIT_NONE #elif defined(VM_INHERIT_NONE) #define FLAG_NOINHERIT VM_INHERIT_NONE +#elif defined(MAP_INHERIT_NONE) +#define FLAG_NOINHERIT MAP_INHERIT_NONE #endif #elif defined(HAVE_MADVISE)

1 0

[tor/master] Merge branch 'tor-github/pr/1049'
by dgoulet＠torproject.org 30 May '19

30 May '19

commit 61bd8f428b2bd637591dace2d7d65af42740b898 Merge: 70553a913 bdf685e47 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu May 30 09:56:18 2019 -0400 Merge branch 'tor-github/pr/1049' changes/bug30614 | 4 ++++ src/lib/malloc/map_anon.c | 4 ++++ 2 files changed, 8 insertions(+)

1 0

[collector/master] Bump version to 1.9.1-dev.
by karsten＠torproject.org 30 May '19

30 May '19

commit d992d8719d507fa8fffee24faa18546da848e16e Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Thu May 30 15:32:07 2019 +0200 Bump version to 1.9.1-dev. --- build.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.xml b/build.xml index d2d1f73..d0fd248 100644 --- a/build.xml +++ b/build.xml @@ -8,7 +8,7 @@ <property name="javadoc-title" value="CollecTor API Documentation"/> <property name="implementation-title" value="CollecTor" /> - <property name="release.version" value="1.9.1" /> + <property name="release.version" value="1.9.1-dev" /> <property name="project-main-class" value="org.torproject.metrics.collector.Main" /> <property name="name" value="collector"/> <property name="metricslibversion" value="2.6.2" />

1 0

[collector/release] Bump version to 1.9.0-dev.
by karsten＠torproject.org 30 May '19

30 May '19

commit e5c75cf463d5dbb6304c5f08825792dd95635a79 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Tue May 14 08:51:57 2019 +0200 Bump version to 1.9.0-dev. --- build.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.xml b/build.xml index b156b01..5be33ff 100644 --- a/build.xml +++ b/build.xml @@ -8,7 +8,7 @@ <property name="javadoc-title" value="CollecTor API Documentation"/> <property name="implementation-title" value="CollecTor" /> - <property name="release.version" value="1.9.0" /> + <property name="release.version" value="1.9.0-dev" /> <property name="project-main-class" value="org.torproject.metrics.collector.Main" /> <property name="name" value="collector"/> <property name="metricslibversion" value="2.6.1" />

1 0

[collector/release] Prepare for 1.9.1 release.
by karsten＠torproject.org 30 May '19

30 May '19

commit df98ac79a3d0cb0e0a4e37387420a2edf60cf093 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed May 29 17:48:07 2019 +0200 Prepare for 1.9.1 release. --- CHANGELOG.md | 7 +++++++ build.xml | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bc1216a..4682fef 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# Changes in version 1.9.1 - 2019-05-29 + + * Medium changes + - Fix synchronizing bandwidth files from other CollecTors. + - Update to metrics-lib 2.6.2. + + # Changes in version 1.9.0 - 2019-05-13 * Medium changes diff --git a/build.xml b/build.xml index 05cba36..d2d1f73 100644 --- a/build.xml +++ b/build.xml @@ -8,7 +8,7 @@ <property name="javadoc-title" value="CollecTor API Documentation"/> <property name="implementation-title" value="CollecTor" /> - <property name="release.version" value="1.9.0-dev" /> + <property name="release.version" value="1.9.1" /> <property name="project-main-class" value="org.torproject.metrics.collector.Main" /> <property name="name" value="collector"/> <property name="metricslibversion" value="2.6.2" />

1 0