August 2019 - tor-commits - lists.torproject.org

[tor/release-0.2.9] Fix a warning about casting the results of GetProcAddress.
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 3a280b35ee45a1e4f4edaa3891a13d449d87fa8b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Aug 8 11:43:42 2019 -0400 Fix a warning about casting the results of GetProcAddress. Fixes bug 31374; bugfix on 0.2.9.1-alpha. --- changes/ticket31374 | 4 ++++ src/common/compat_time.c | 3 +-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/changes/ticket31374 b/changes/ticket31374 new file mode 100644 index 000000000..e8eef9cd4 --- /dev/null +++ b/changes/ticket31374 @@ -0,0 +1,4 @@ + o Minor bugfixes (compilation warning): + - Fix a compilation warning on Windows about casting a function + pointer for GetTickCount64(). Fixes bug 31374; bugfix on + 0.2.9.1-alpha. diff --git a/src/common/compat_time.c b/src/common/compat_time.c index d044bbe1d..52da609db 100644 --- a/src/common/compat_time.c +++ b/src/common/compat_time.c @@ -443,7 +443,7 @@ monotime_init_internal(void) HANDLE h = load_windows_system_library(TEXT("kernel32.dll")); if (h) { - GetTickCount64_fn = (GetTickCount64_fn_t) + GetTickCount64_fn = (GetTickCount64_fn_t) (void(*)(void)) GetProcAddress(h, "GetTickCount64"); } // FreeLibrary(h) ? @@ -654,4 +654,3 @@ monotime_coarse_absolute_msec(void) return monotime_coarse_absolute_nsec() / ONE_MILLION; } #endif -

1 0

[tor/release-0.3.5] Protect buffers against INT_MAX datalen overflows.
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 5a6ab3e7dbf601ae3cc006855f7f4e6c834cbeb2 Author: Tobias Stoeckmann <tobias(a)stoeckmann.org> Date: Sun Mar 31 17:32:41 2019 +0200 Protect buffers against INT_MAX datalen overflows. Many buffer functions have a hard limit of INT_MAX for datalen, but this limitation is not enforced in all functions: - buf_move_all may exceed that limit with too many chunks - buf_move_to_buf exceeds that limit with invalid buf_flushlen argument - buf_new_with_data may exceed that limit (unit tests only) This patch adds some annotations in some buf_pos_t functions to guarantee that no out of boundary access could occur even if another function lacks safe guards against datalen overflows. Signed-off-by: Tobias Stoeckmann <tobias(a)stoeckmann.org> --- src/common/buffers.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/common/buffers.c b/src/common/buffers.c index a01add9be..3951877c5 100644 --- a/src/common/buffers.c +++ b/src/common/buffers.c @@ -273,7 +273,7 @@ buf_t * buf_new_with_data(const char *cp, size_t sz) { /* Validate arguments */ - if (!cp || sz <= 0) { + if (!cp || sz <= 0 || sz >= INT_MAX) { return NULL; } @@ -818,7 +818,7 @@ buf_move_to_buf(buf_t *buf_out, buf_t *buf_in, size_t *buf_flushlen) char b[4096]; size_t cp, len; - if (BUG(buf_out->datalen >= INT_MAX)) + if (BUG(buf_out->datalen >= INT_MAX || *buf_flushlen >= INT_MAX)) return -1; if (BUG(buf_out->datalen >= INT_MAX - *buf_flushlen)) return -1; @@ -850,6 +850,10 @@ buf_move_all(buf_t *buf_out, buf_t *buf_in) tor_assert(buf_out); if (!buf_in) return; + if (BUG(buf_out->datalen >= INT_MAX || buf_in->datalen >= INT_MAX)) + return; + if (BUG(buf_out->datalen >= INT_MAX - buf_in->datalen)) + return; if (buf_out->head == NULL) { buf_out->head = buf_in->head; @@ -917,6 +921,7 @@ buf_find_pos_of_char(char ch, buf_pos_t *out) static inline int buf_pos_inc(buf_pos_t *pos) { + tor_assert(pos->pos < INT_MAX - 1); ++pos->pos; if (pos->pos == (off_t)pos->chunk->datalen) { if (!pos->chunk->next) @@ -997,6 +1002,7 @@ buf_find_offset_of_char(buf_t *buf, char ch) { chunk_t *chunk; off_t offset = 0; + tor_assert(buf->datalen < INT_MAX); for (chunk = buf->head; chunk; chunk = chunk->next) { char *cp = memchr(chunk->data, ch, chunk->datalen); if (cp) @@ -1125,6 +1131,7 @@ buf_assert_ok(buf_t *buf) for (ch = buf->head; ch; ch = ch->next) { total += ch->datalen; tor_assert(ch->datalen <= ch->memlen); + tor_assert(ch->datalen < INT_MAX); tor_assert(ch->data >= &ch->mem[0]); tor_assert(ch->data <= &ch->mem[0]+ch->memlen); if (ch->data == &ch->mem[0]+ch->memlen) {

1 0

[tor/release-0.3.5] Changes file for bug30041
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit c24928dd8ffb4c833bae9701921d06072a147938 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Apr 9 12:03:22 2019 -0400 Changes file for bug30041 --- changes/bug30041 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/bug30041 b/changes/bug30041 new file mode 100644 index 000000000..801c8f67a --- /dev/null +++ b/changes/bug30041 @@ -0,0 +1,5 @@ + o Minor bugfixes (hardening): + - Verify in more places that we are not about to create a buffer + with more than INT_MAX bytes, to avoid possible OOB access in the event + of bugs. Fixes bug 30041; bugfix on 0.2.0.16. Found and fixed by + Tobias Stoeckmann.

1 0

[tor/release-0.2.9] Merge remote-tracking branch 'tor-github/pr/1078' into maint-0.2.9
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 254c1bac453fdb7d3e29a5cde9757542990a6989 Merge: e07d08a16 ba83c1e5c Author: teor <teor(a)torproject.org> Date: Sat Aug 10 07:21:56 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1078' into maint-0.2.9 changes/bug30781 | 4 ++++ src/or/routerparse.c | 3 +++ 2 files changed, 7 insertions(+)

1 0

[tor/release-0.2.9] Fix #28525 changes file that is breaking CI.
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit c35aded00a19f26f3124584e7d0f561cf579efec Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Mar 12 20:11:51 2019 +0200 Fix #28525 changes file that is breaking CI. --- changes/bug28525 | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/changes/bug28525 b/changes/bug28525 index 392a9265e..988ffb219 100644 --- a/changes/bug28525 +++ b/changes/bug28525 @@ -1,8 +1,7 @@ - o Minor bugfixes (address selection): + o Minor features (address selection): - Make Tor aware of the RFC 6598 (Carrier Grade NAT) IP range, which is the subnet 100.64.0.0/10. This is deployed by many ISPs as an alternative to RFC 1918 that does not break existing internal networks. This patch fixes security issues caused by RFC 6518 by blocking control ports on these addresses and warns users if client ports or ExtORPorts are listening on - a RFC 6598 address. Fixes bug 28525; bugfix on 0.4.1.1-alpha. Patch by - Neel Chauhan. + a RFC 6598 address. Closes ticket 28525. Patch by Neel Chauhan.

1 0

[tor/release-0.3.5] Check return value of buf_move_to_buf for error.
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 0fa95308fe5fcce8842530fcae5a49188856e6ac Author: Tobias Stoeckmann <tobias(a)stoeckmann.org> Date: Sun Mar 31 17:33:11 2019 +0200 Check return value of buf_move_to_buf for error. If the concatenation of connection buffer and the buffer of linked connection exceeds INT_MAX bytes, then buf_move_to_buf returns -1 as an error value. This value is currently casted to size_t (variable n_read) and will erroneously lead to an increasement of variable "max_to_read". This in turn can be used to call connection_buf_read_from_socket to store more data inside the buffer than expected and clogging the connection buffer. If the linked connection buffer was able to overflow INT_MAX, the call of buf_move_to_buf would have previously internally triggered an integer overflow, corrupting the state of the connection buffer. Signed-off-by: Tobias Stoeckmann <tobias(a)stoeckmann.org> --- src/or/connection.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/or/connection.c b/src/or/connection.c index 791fd95c2..4f636eeb8 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -3581,6 +3581,10 @@ connection_read_to_buf(connection_t *conn, ssize_t *max_to_read, if (conn->linked_conn) { result = move_buf_to_buf(conn->inbuf, conn->linked_conn->outbuf, &conn->linked_conn->outbuf_flushlen); + if (BUG(result<0)) { + log_warn(LD_BUG, "reading from linked connection buffer failed."); + return -1; + } } else { result = 0; }

1 0

[tor/release-0.2.9] Merge remote-tracking branch 'tor-github/pr/1052' into maint-0.2.9
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit e07d08a169c3dd43f4cd134c8f993c3f199c2bcc Merge: e0f9a8222 0e0cf4abd Author: teor <teor(a)torproject.org> Date: Sat Aug 10 07:21:43 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1052' into maint-0.2.9 changes/bug30561 | 6 ++++++ src/common/compat.c | 17 +++++++++++++---- 2 files changed, 19 insertions(+), 4 deletions(-)

1 0

[tor/release-0.2.9] Merge remote-tracking branch 'tor-github/pr/1221' into combined31343_31374_029
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 2bc8989d833c3b583395380031e9b730d1c3fb37 Merge: 7667c1cba 3a280b35e Author: teor <teor(a)torproject.org> Date: Fri Aug 9 09:48:41 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1221' into combined31343_31374_029 changes/ticket31374 | 4 ++++ src/common/compat_time.c | 3 +-- 2 files changed, 5 insertions(+), 2 deletions(-)

1 0

[tor/release-0.3.5] test/relay: add a missing typedef
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 031ed59dbaf62d9cebd09f98f563c228fe6822f6 Author: teor <teor(a)torproject.org> Date: Wed Apr 17 11:14:05 2019 +1000 test/relay: add a missing typedef In 0.3.4 and later, these functions are declared in rephist.h: STATIC uint64_t find_largest_max(bw_array_t *b); STATIC void commit_max(bw_array_t *b); STATIC void advance_obs(bw_array_t *b); But in 0.2.9, they are declared in rephist.c and test_relay.c. So compilers fail with a "must use 'struct' tag" error. We add the missing struct typedef in test_relay.c, to match the declarations in rephist.c. (Merge commit 813019cc57 moves these functions into rephist.h instead.) Fixes bug 30184; not in any released version of Tor. --- src/test/test_relay.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/test/test_relay.c b/src/test/test_relay.c index 57dcb2406..d4ebb2338 100644 --- a/src/test/test_relay.c +++ b/src/test/test_relay.c @@ -19,6 +19,8 @@ static or_circuit_t * new_fake_orcirc(channel_t *nchan, channel_t *pchan); static void test_relay_append_cell_to_circuit_queue(void *arg); + +typedef struct bw_array_t bw_array_t; uint64_t find_largest_max(bw_array_t *b); void commit_max(bw_array_t *b); void advance_obs(bw_array_t *b);

1 0

[tor/release-0.2.9] Merge remote-tracking branch 'tor-github/pr/1229' into maint-0.2.9
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit e0f9a8222b53772a6879ecddb41738a223e3b888 Merge: c35aded00 37bd7fa50 Author: teor <teor(a)torproject.org> Date: Sat Aug 10 07:21:31 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1229' into maint-0.2.9 changes/bug30041 | 5 +++++ src/or/buffers.c | 4 +++- src/or/connection.c | 4 ++++ 3 files changed, 12 insertions(+), 1 deletion(-)

1 0