March 2020 - tor-commits - lists.torproject.org

[tor/release-0.4.1] circpad_setup_machine_on_circ(): exit early on error.
by nickm＠torproject.org 17 Mar '20

17 Mar '20

commit 78bcfc1280b322ba57a10a116457616eeb742ab6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Mar 14 14:44:33 2020 -0400 circpad_setup_machine_on_circ(): exit early on error. This function does a nonfatal assertion to make sure that a machine is not registered twice, but Tobias Pulls found a case where it happens. Instead, make the function exit early so that it doesn't cause a remotely triggered memory leak. Fixes bug 33619; bugfix on 0.4.0.1-alpha. This is also tracked as TROVE-2020-004. --- changes/ticket33619 | 5 +++++ src/core/or/circuitpadding.c | 9 ++++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/changes/ticket33619 b/changes/ticket33619 new file mode 100644 index 000000000..3c52858b3 --- /dev/null +++ b/changes/ticket33619 @@ -0,0 +1,5 @@ + o Major bugfixes (circuit padding, memory leaks): + - Avoid a remotely triggered memory leak in the case that a circuit + padding machine is somehow negotiated twice on the same circuit. Fixes + bug 33619; bugfix on 0.4.0.1-alpha. Found by Tobias Pulls. This is + also tracked as TROVE-2020-004. diff --git a/src/core/or/circuitpadding.c b/src/core/or/circuitpadding.c index a62cdcf9e..72b770113 100644 --- a/src/core/or/circuitpadding.c +++ b/src/core/or/circuitpadding.c @@ -2381,9 +2381,12 @@ circpad_setup_machine_on_circ(circuit_t *on_circ, return; } - tor_assert_nonfatal(on_circ->padding_machine[machine->machine_index] - == NULL); - tor_assert_nonfatal(on_circ->padding_info[machine->machine_index] == NULL); + IF_BUG_ONCE(on_circ->padding_machine[machine->machine_index] != NULL) { + return; + } + IF_BUG_ONCE(on_circ->padding_info[machine->machine_index] != NULL) { + return; + } /* Log message */ if (CIRCUIT_IS_ORIGIN(on_circ)) {

1 0

[tor/master] Merge branch 'maint-0.4.2' into maint-0.4.3
by nickm＠torproject.org 17 Mar '20

17 Mar '20

commit 6803373aab2292fe7286d1e19e25d5016b6ac9b8 Merge: bc4c89eb2 4ee269941 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 13:56:10 2020 -0400 Merge branch 'maint-0.4.2' into maint-0.4.3 changes/ticket33619 | 5 +++++ src/core/or/circuitpadding.c | 9 ++++++--- 2 files changed, 11 insertions(+), 3 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.4.3'
by nickm＠torproject.org 17 Mar '20

17 Mar '20

commit d4595b344a1a32547c8578e1d62cee0beb63dc78 Merge: d3c4ed08f 6803373aa Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 13:56:10 2020 -0400 Merge branch 'maint-0.4.3' changes/ticket33619 | 5 +++++ src/core/or/circuitpadding.c | 9 ++++++--- 2 files changed, 11 insertions(+), 3 deletions(-)

1 0

[tor/release-0.4.1] Merge branch 'maint-0.4.1' into release-0.4.1
by nickm＠torproject.org 17 Mar '20

17 Mar '20

commit c1560f6513269c1d929f7bc98e1961d1afd23574 Merge: 6031aa45f cec647ff3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 13:56:10 2020 -0400 Merge branch 'maint-0.4.1' into release-0.4.1 changes/ticket33619 | 5 +++++ src/core/or/circuitpadding.c | 9 ++++++--- 2 files changed, 11 insertions(+), 3 deletions(-)

1 0

[tor/release-0.4.2] Merge branch 'maint-0.4.1' into maint-0.4.2
by nickm＠torproject.org 17 Mar '20

17 Mar '20

commit 4ee2699416dc612b859f6ba77e6fcd2e7e55c1b7 Merge: e15a621ac cec647ff3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 13:56:10 2020 -0400 Merge branch 'maint-0.4.1' into maint-0.4.2 changes/ticket33619 | 5 +++++ src/core/or/circuitpadding.c | 9 ++++++--- 2 files changed, 11 insertions(+), 3 deletions(-)

1 0

[tor/release-0.4.2] Merge branch 'maint-0.4.2' into release-0.4.2
by nickm＠torproject.org 17 Mar '20

17 Mar '20

commit 9bdcfe51e28e4f522173f21da34283d5f1ba728c Merge: 0d2dcc15c 4ee269941 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 13:56:10 2020 -0400 Merge branch 'maint-0.4.2' into release-0.4.2 changes/ticket33619 | 5 +++++ src/core/or/circuitpadding.c | 9 ++++++--- 2 files changed, 11 insertions(+), 3 deletions(-)

1 0

[tor/release-0.4.1] Merge branch 'trove_2020_004_041_v2' into maint-0.4.1
by nickm＠torproject.org 17 Mar '20

17 Mar '20

commit cec647ff3eab20c97a744a59b808eb49760acfd3 Merge: 5f4e14b8c 78bcfc128 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 13:56:03 2020 -0400 Merge branch 'trove_2020_004_041_v2' into maint-0.4.1 changes/ticket33619 | 5 +++++ src/core/or/circuitpadding.c | 9 ++++++--- 2 files changed, 11 insertions(+), 3 deletions(-)

1 0

[tor/release-0.4.2] circpad_setup_machine_on_circ(): exit early on error.
by nickm＠torproject.org 17 Mar '20

17 Mar '20

commit 78bcfc1280b322ba57a10a116457616eeb742ab6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Mar 14 14:44:33 2020 -0400 circpad_setup_machine_on_circ(): exit early on error. This function does a nonfatal assertion to make sure that a machine is not registered twice, but Tobias Pulls found a case where it happens. Instead, make the function exit early so that it doesn't cause a remotely triggered memory leak. Fixes bug 33619; bugfix on 0.4.0.1-alpha. This is also tracked as TROVE-2020-004. --- changes/ticket33619 | 5 +++++ src/core/or/circuitpadding.c | 9 ++++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/changes/ticket33619 b/changes/ticket33619 new file mode 100644 index 000000000..3c52858b3 --- /dev/null +++ b/changes/ticket33619 @@ -0,0 +1,5 @@ + o Major bugfixes (circuit padding, memory leaks): + - Avoid a remotely triggered memory leak in the case that a circuit + padding machine is somehow negotiated twice on the same circuit. Fixes + bug 33619; bugfix on 0.4.0.1-alpha. Found by Tobias Pulls. This is + also tracked as TROVE-2020-004. diff --git a/src/core/or/circuitpadding.c b/src/core/or/circuitpadding.c index a62cdcf9e..72b770113 100644 --- a/src/core/or/circuitpadding.c +++ b/src/core/or/circuitpadding.c @@ -2381,9 +2381,12 @@ circpad_setup_machine_on_circ(circuit_t *on_circ, return; } - tor_assert_nonfatal(on_circ->padding_machine[machine->machine_index] - == NULL); - tor_assert_nonfatal(on_circ->padding_info[machine->machine_index] == NULL); + IF_BUG_ONCE(on_circ->padding_machine[machine->machine_index] != NULL) { + return; + } + IF_BUG_ONCE(on_circ->padding_info[machine->machine_index] != NULL) { + return; + } /* Log message */ if (CIRCUIT_IS_ORIGIN(on_circ)) {

1 0

[tor/release-0.4.3] Merge branch 'maint-0.4.2' into maint-0.4.3
by nickm＠torproject.org 17 Mar '20

17 Mar '20

commit 6803373aab2292fe7286d1e19e25d5016b6ac9b8 Merge: bc4c89eb2 4ee269941 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 13:56:10 2020 -0400 Merge branch 'maint-0.4.2' into maint-0.4.3 changes/ticket33619 | 5 +++++ src/core/or/circuitpadding.c | 9 ++++++--- 2 files changed, 11 insertions(+), 3 deletions(-)

1 0

[tor/release-0.4.3] Merge branch 'maint-0.4.1' into maint-0.4.2
by nickm＠torproject.org 17 Mar '20

17 Mar '20

commit 4ee2699416dc612b859f6ba77e6fcd2e7e55c1b7 Merge: e15a621ac cec647ff3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 13:56:10 2020 -0400 Merge branch 'maint-0.4.1' into maint-0.4.2 changes/ticket33619 | 5 +++++ src/core/or/circuitpadding.c | 9 ++++++--- 2 files changed, 11 insertions(+), 3 deletions(-)

1 0