August 2019 - tor-commits - lists.torproject.org

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/1052' into maint-0.2.9
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit e07d08a169c3dd43f4cd134c8f993c3f199c2bcc Merge: e0f9a8222 0e0cf4abd Author: teor <teor(a)torproject.org> Date: Sat Aug 10 07:21:43 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1052' into maint-0.2.9 changes/bug30561 | 6 ++++++ src/common/compat.c | 17 +++++++++++++---- 2 files changed, 19 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/957' into maint-0.2.9
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 05018d55cabdf9c0f80d6bf78ca30c795b60500e Merge: 2bc8989d8 031ed59db Author: teor <teor(a)torproject.org> Date: Fri Aug 9 13:50:42 2019 +1000 Merge remote-tracking branch 'tor-github/pr/957' into maint-0.2.9 src/or/rephist.h | 4 +--- src/test/test_relay.c | 2 ++ 2 files changed, 3 insertions(+), 3 deletions(-)

1 0

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/762' into maint-0.2.9
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 45f30ba5faf1c27fd8404c2fb95b1a79b9f59984 Merge: 05018d55c 63b404911 Author: teor <teor(a)torproject.org> Date: Fri Aug 9 13:53:34 2019 +1000 Merge remote-tracking branch 'tor-github/pr/762' into maint-0.2.9 changes/bug28525 | 8 ++++++++ src/common/address.c | 19 +++++++++++++++---- src/test/test_addr.c | 18 ++++++++++++++++++ 3 files changed, 41 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.3.5] Fixed tor_vasprintf on systems without vasprintf.
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 0d5a0b4f0ccc804913fbca20acf5fc62f52570b8 Author: Tobias Stoeckmann <tobias(a)stoeckmann.org> Date: Wed May 29 09:33:24 2019 -0400 Fixed tor_vasprintf on systems without vasprintf. If tor is compiled on a system with neither vasprintf nor _vscprintf, the fallback implementation exposes a logic flaw which prevents proper usage of strings longer than 127 characters: * tor_vsnprintf returns -1 if supplied buffer is not large enough, but tor_vasprintf uses this function to retrieve required length * the result of tor_vsnprintf is not properly checked for negative return values Both aspects together could in theory lead to exposure of uninitialized stack memory in the resulting string. This requires an invalid format string or data that exceeds integer limitations. Fortunately tor is not even able to run with this implementation because it runs into asserts early on during startup. Also the unit tests fail during a "make check" run. Signed-off-by: Tobias Stoeckmann <tobias(a)stoeckmann.org> [backported to 0.2.9 by nickm] --- src/common/compat.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/common/compat.c b/src/common/compat.c index 975875112..d3bc2f5fe 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -558,10 +558,17 @@ tor_vasprintf(char **strp, const char *fmt, va_list args) int len, r; va_list tmp_args; va_copy(tmp_args, args); - /* vsnprintf() was properly checked but tor_vsnprintf() available so - * why not use it? */ - len = tor_vsnprintf(buf, sizeof(buf), fmt, tmp_args); + /* Use vsnprintf to retrieve needed length. tor_vsnprintf() is not an option + * here because it will simply return -1 if buf is not large enough to hold the + * complete string. + */ + len = vsnprintf(buf, sizeof(buf), fmt, tmp_args); va_end(tmp_args); + buf[sizeof(buf) - 1] = '\0'; + if (len < 0) { + *strp = NULL; + return -1; + } if (len < (int)sizeof(buf)) { *strp = tor_strdup(buf); return len;

1 0

[tor/maint-0.3.5] Merge branch 'bug30781_029' into bug30781_034
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit dc8e3cd5ce2affb849ed07db8b4a7788769c5935 Merge: a521c4278 ba83c1e5c Author: teor <teor(a)torproject.org> Date: Thu Jun 6 09:53:02 2019 +1000 Merge branch 'bug30781_029' into bug30781_034 changes/bug30781 | 4 ++++ src/or/routerparse.c | 3 +++ 2 files changed, 7 insertions(+)

1 0

[tor/maint-0.3.5] Merge branch 'ticket30561_029' into ticket30561_035
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 8f0b29961eb4b9965f22bbcabdc0aa0354c19a4a Merge: e5deb2bbc 0e0cf4abd Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 29 09:43:20 2019 -0400 Merge branch 'ticket30561_029' into ticket30561_035 changes/bug30561 | 6 ++++++ src/lib/string/printf.c | 16 +++++++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-) diff --cc src/lib/string/printf.c index 415d4ac4a,000000000..a5cb71ce0 mode 100644,000000..100644 --- a/src/lib/string/printf.c +++ b/src/lib/string/printf.c @@@ -1,157 -1,0 +1,167 @@@ +/* Copyright (c) 2003-2004, Roger Dingledine + * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. + * Copyright (c) 2007-2019, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * \file printf.c + * \brief Compatibility wrappers around snprintf and its friends + **/ + +#include "lib/string/printf.h" +#include "lib/err/torerr.h" +#include "lib/cc/torint.h" +#include "lib/malloc/malloc.h" + +#include <stdlib.h> +#include <stdio.h> + +/** Replacement for snprintf. Differs from platform snprintf in two + * ways: First, always NUL-terminates its output. Second, always + * returns -1 if the result is truncated. (Note that this return + * behavior does <i>not</i> conform to C99; it just happens to be + * easier to emulate "return -1" with conformant implementations than + * it is to emulate "return number that would be written" with + * non-conformant implementations.) */ +int +tor_snprintf(char *str, size_t size, const char *format, ...) +{ + va_list ap; + int r; + va_start(ap,format); + r = tor_vsnprintf(str,size,format,ap); + va_end(ap); + return r; +} + +/** Replacement for vsnprintf; behavior differs as tor_snprintf differs from + * snprintf. + */ +int +tor_vsnprintf(char *str, size_t size, const char *format, va_list args) +{ + int r; + if (size == 0) + return -1; /* no place for the NUL */ + if (size > SIZE_T_CEILING) + return -1; +#ifdef _WIN32 + r = _vsnprintf(str, size, format, args); +#else + r = vsnprintf(str, size, format, args); +#endif + str[size-1] = '\0'; + if (r < 0 || r >= (ssize_t)size) + return -1; + return r; +} + +/** + * Portable asprintf implementation. Does a printf() into a newly malloc'd + * string. Sets *<b>strp</b> to this string, and returns its length (not + * including the terminating NUL character). + * + * You can treat this function as if its implementation were something like + <pre> + char buf[_INFINITY_]; + tor_snprintf(buf, sizeof(buf), fmt, args); + *strp = tor_strdup(buf); + return strlen(*strp): + </pre> + * Where _INFINITY_ is an imaginary constant so big that any string can fit + * into it. + */ +int +tor_asprintf(char **strp, const char *fmt, ...) +{ + int r; + va_list args; + va_start(args, fmt); + r = tor_vasprintf(strp, fmt, args); + va_end(args); + if (!*strp || r < 0) { + /* LCOV_EXCL_START */ + raw_assert_unreached_msg("Internal error in asprintf"); + /* LCOV_EXCL_STOP */ + } + return r; +} + +/** + * Portable vasprintf implementation. Does a printf() into a newly malloc'd + * string. Differs from regular vasprintf in the same ways that + * tor_asprintf() differs from regular asprintf. + */ +int +tor_vasprintf(char **strp, const char *fmt, va_list args) +{ + /* use a temporary variable in case *strp is in args. */ + char *strp_tmp=NULL; +#ifdef HAVE_VASPRINTF + /* If the platform gives us one, use it. */ + int r = vasprintf(&strp_tmp, fmt, args); + if (r < 0) + *strp = NULL; // LCOV_EXCL_LINE -- no cross-platform way to force this + else + *strp = strp_tmp; + return r; +#elif defined(HAVE__VSCPRINTF) + /* On Windows, _vsnprintf won't tell us the length of the string if it + * overflows, so we need to use _vcsprintf to tell how much to allocate */ + int len, r; + va_list tmp_args; + va_copy(tmp_args, args); + len = _vscprintf(fmt, tmp_args); + va_end(tmp_args); + if (len < 0) { + *strp = NULL; + return -1; + } + strp_tmp = tor_malloc(len + 1); + r = _vsnprintf(strp_tmp, len+1, fmt, args); + if (r != len) { + tor_free(strp_tmp); + *strp = NULL; + return -1; + } + *strp = strp_tmp; + return len; +#else + /* Everywhere else, we have a decent vsnprintf that tells us how many + * characters we need. We give it a try on a short buffer first, since + * it might be nice to avoid the second vsnprintf call. + */ ++ /* XXXX This code spent a number of years broken (see bug 30651). It is ++ * possible that no Tor users actually run on systems without vasprintf() or ++ * _vscprintf(). If so, we should consider removing this code. */ + char buf[128]; + int len, r; + va_list tmp_args; + va_copy(tmp_args, args); - /* vsnprintf() was properly checked but tor_vsnprintf() available so - * why not use it? */ - len = tor_vsnprintf(buf, sizeof(buf), fmt, tmp_args); ++ /* Use vsnprintf to retrieve needed length. tor_vsnprintf() is not an ++ * option here because it will simply return -1 if buf is not large enough ++ * to hold the complete string. ++ */ ++ len = vsnprintf(buf, sizeof(buf), fmt, tmp_args); + va_end(tmp_args); ++ buf[sizeof(buf) - 1] = '\0'; ++ if (len < 0) { ++ *strp = NULL; ++ return -1; ++ } + if (len < (int)sizeof(buf)) { + *strp = tor_strdup(buf); + return len; + } + strp_tmp = tor_malloc(len+1); + /* use of tor_vsnprintf() will ensure string is null terminated */ + r = tor_vsnprintf(strp_tmp, len+1, fmt, args); + if (r != len) { + tor_free(strp_tmp); + *strp = NULL; + return -1; + } + *strp = strp_tmp; + return len; +#endif /* defined(HAVE_VASPRINTF) || ... */ +}

1 0

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/1054' into maint-0.3.5
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 1ba2bd3599e94bb2fa533cde9e1ef296b4124ce4 Merge: e3ba9b7a7 8f0b29961 Author: teor <teor(a)torproject.org> Date: Fri Aug 9 14:01:50 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1054' into maint-0.3.5 changes/bug30561 | 6 ++++++ src/lib/string/printf.c | 16 +++++++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-)

1 0

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/1229' into maint-0.2.9
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit e0f9a8222b53772a6879ecddb41738a223e3b888 Merge: c35aded00 37bd7fa50 Author: teor <teor(a)torproject.org> Date: Sat Aug 10 07:21:31 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1229' into maint-0.2.9 changes/bug30041 | 5 +++++ src/or/buffers.c | 4 +++- src/or/connection.c | 4 ++++ 3 files changed, 12 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.3.5] Merge branch 'maint-0.2.9' into maint-0.3.5
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit 5df0b36623005526588c35cb63b47dd256dcc5b7 Merge: 654769bce 254c1bac4 Author: teor <teor(a)torproject.org> Date: Sat Aug 10 07:25:57 2019 +1000 Merge branch 'maint-0.2.9' into maint-0.3.5 Delete src/or/buffers.c which was fixup'ed in 0.2.9 but moved in 0.3.5. The 0.2.9 fix is not required for the 0.3.5 patch. Resolves merge conflict caused by 30041.

1 0

[tor/maint-0.3.5] dirparse: Stop crashing when parsing unknown descriptor purpose annotations
by teor＠torproject.org 09 Aug '19

09 Aug '19

commit ba83c1e5cf0e4ba0d63cb3728da059a9b241a161 Author: teor <teor(a)torproject.org> Date: Thu Jun 6 09:12:14 2019 +1000 dirparse: Stop crashing when parsing unknown descriptor purpose annotations We think this bug can only be triggered by modifying a local file. Fixes bug 30781; bugfix on 0.2.0.8-alpha. --- changes/bug30781 | 4 ++++ src/or/routerparse.c | 3 +++ 2 files changed, 7 insertions(+) diff --git a/changes/bug30781 b/changes/bug30781 new file mode 100644 index 000000000..7c7adf470 --- /dev/null +++ b/changes/bug30781 @@ -0,0 +1,4 @@ + o Minor bugfixes (directory authorities): + - Stop crashing after parsing an unknown descriptor purpose annotation. + We think this bug can only be triggered by modifying a local file. + Fixes bug 30781; bugfix on 0.2.0.8-alpha. diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 37d2d975f..f046cc39b 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -1921,6 +1921,9 @@ router_parse_entry_from_string(const char *s, const char *end, if ((tok = find_opt_by_keyword(tokens, A_PURPOSE))) { tor_assert(tok->n_args); router->purpose = router_purpose_from_string(tok->args[0]); + if (router->purpose == ROUTER_PURPOSE_UNKNOWN) { + goto err; + } } else { router->purpose = ROUTER_PURPOSE_GENERAL; }

1 0