- tor-commits - lists.torproject.org

[tor/release-0.2.8] Merge branch 'maint-0.2.8' into release-0.2.8
by nickm＠torproject.org 25 May '16

25 May '16

commit 3e2d061397f451ba7b818d9b5b407523b2be4b89 Merge: e32281b 36b2b48 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 25 16:58:58 2016 -0400 Merge branch 'maint-0.2.8' into release-0.2.8 changes/bug18668 | 3 +++ src/test/testing_common.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-)

1 0

[tor/master] Merge branch 'maint-0.2.8'
by nickm＠torproject.org 25 May '16

25 May '16

commit 28cbcd033cadc9dfcabf4e179fc3649d8ec595e2 Merge: 44ea3dc f2d614c Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 25 16:40:51 2016 -0400 Merge branch 'maint-0.2.8' src/or/routerlist.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)

1 0

[tor/release-0.2.8] Merge branch 'maint-0.2.8' into release-0.2.8
by nickm＠torproject.org 25 May '16

25 May '16

commit e32281b00095dbc764e995cf57290c9c1b0c9660 Merge: 693e48a f2d614c Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 25 16:12:10 2016 -0400 Merge branch 'maint-0.2.8' into release-0.2.8 src/or/routerlist.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)

1 0

[tor/release-0.2.8] Merge branch 'bug19175_028_v2' into maint-0.2.8
by nickm＠torproject.org 25 May '16

25 May '16

commit f2d614c3d93aceac4954f7cd593213a5fcfbb123 Merge: 6d375f1 9cf6af7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 25 16:12:01 2016 -0400 Merge branch 'bug19175_028_v2' into maint-0.2.8 src/or/routerlist.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)

1 0

[tor/release-0.2.8] Fix a double-free bug in routerlist_reparse_old
by nickm＠torproject.org 25 May '16

25 May '16

commit 9cf6af76eb250dc0716185e349a92b2def6981d3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 25 11:52:52 2016 -0400 Fix a double-free bug in routerlist_reparse_old I introduced this bug when I moved signing_key_cert into signed_descriptor_t. Bug not in any released Tor. Fixes bug 19175, and another case of 19128. Just like signed_descriptor_from_routerinfo(), routerlist_reparse_old() copies the fields from one signed_descriptor_t to another, and then clears the fields from the original that would have been double-freed by freeing the original. But when I fixed the s_d_f_r() bug [#19128] in 50cbf220994c7cec593, I missed the fact that the code was duplicated in r_p_o(). Duplicated code strikes again! For a longer-term solution here, I am not only adding the missing fix to r_p_o(): I am also extracting the duplicated code into a new function. Many thanks to toralf for patiently sending me stack traces until one made sense. --- src/or/routerlist.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index d49814f..a08b5f3 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -2938,6 +2938,19 @@ signed_descriptor_free(signed_descriptor_t *sd) tor_free(sd); } +/** Copy src into dest, and steal all references inside src so that when + * we free src, we don't mess up dest. */ +static void +signed_descriptor_move(signed_descriptor_t *dest, + signed_descriptor_t *src) +{ + tor_assert(dest != src); + memcpy(dest, src, sizeof(signed_descriptor_t)); + src->signed_descriptor_body = NULL; + src->signing_key_cert = NULL; + dest->routerlist_index = -1; +} + /** Extract a signed_descriptor_t from a general routerinfo, and free the * routerinfo. */ @@ -2947,10 +2960,7 @@ signed_descriptor_from_routerinfo(routerinfo_t *ri) signed_descriptor_t *sd; tor_assert(ri->purpose == ROUTER_PURPOSE_GENERAL); sd = tor_malloc_zero(sizeof(signed_descriptor_t)); - memcpy(sd, &(ri->cache_info), sizeof(signed_descriptor_t)); - sd->routerlist_index = -1; - ri->cache_info.signed_descriptor_body = NULL; - ri->cache_info.signing_key_cert = NULL; + signed_descriptor_move(sd, &ri->cache_info); routerinfo_free(ri); return sd; } @@ -3436,9 +3446,7 @@ routerlist_reparse_old(routerlist_t *rl, signed_descriptor_t *sd) 0, 1, NULL, NULL); if (!ri) return NULL; - memcpy(&ri->cache_info, sd, sizeof(signed_descriptor_t)); - sd->signed_descriptor_body = NULL; /* Steal reference. */ - ri->cache_info.routerlist_index = -1; + signed_descriptor_move(&ri->cache_info, sd); routerlist_remove_old(rl, sd, -1);

1 0

[tor/master] Fix a double-free bug in routerlist_reparse_old
by nickm＠torproject.org 25 May '16

25 May '16

commit 9cf6af76eb250dc0716185e349a92b2def6981d3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 25 11:52:52 2016 -0400 Fix a double-free bug in routerlist_reparse_old I introduced this bug when I moved signing_key_cert into signed_descriptor_t. Bug not in any released Tor. Fixes bug 19175, and another case of 19128. Just like signed_descriptor_from_routerinfo(), routerlist_reparse_old() copies the fields from one signed_descriptor_t to another, and then clears the fields from the original that would have been double-freed by freeing the original. But when I fixed the s_d_f_r() bug [#19128] in 50cbf220994c7cec593, I missed the fact that the code was duplicated in r_p_o(). Duplicated code strikes again! For a longer-term solution here, I am not only adding the missing fix to r_p_o(): I am also extracting the duplicated code into a new function. Many thanks to toralf for patiently sending me stack traces until one made sense. --- src/or/routerlist.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index d49814f..a08b5f3 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -2938,6 +2938,19 @@ signed_descriptor_free(signed_descriptor_t *sd) tor_free(sd); } +/** Copy src into dest, and steal all references inside src so that when + * we free src, we don't mess up dest. */ +static void +signed_descriptor_move(signed_descriptor_t *dest, + signed_descriptor_t *src) +{ + tor_assert(dest != src); + memcpy(dest, src, sizeof(signed_descriptor_t)); + src->signed_descriptor_body = NULL; + src->signing_key_cert = NULL; + dest->routerlist_index = -1; +} + /** Extract a signed_descriptor_t from a general routerinfo, and free the * routerinfo. */ @@ -2947,10 +2960,7 @@ signed_descriptor_from_routerinfo(routerinfo_t *ri) signed_descriptor_t *sd; tor_assert(ri->purpose == ROUTER_PURPOSE_GENERAL); sd = tor_malloc_zero(sizeof(signed_descriptor_t)); - memcpy(sd, &(ri->cache_info), sizeof(signed_descriptor_t)); - sd->routerlist_index = -1; - ri->cache_info.signed_descriptor_body = NULL; - ri->cache_info.signing_key_cert = NULL; + signed_descriptor_move(sd, &ri->cache_info); routerinfo_free(ri); return sd; } @@ -3436,9 +3446,7 @@ routerlist_reparse_old(routerlist_t *rl, signed_descriptor_t *sd) 0, 1, NULL, NULL); if (!ri) return NULL; - memcpy(&ri->cache_info, sd, sizeof(signed_descriptor_t)); - sd->signed_descriptor_body = NULL; /* Steal reference. */ - ri->cache_info.routerlist_index = -1; + signed_descriptor_move(&ri->cache_info, sd); routerlist_remove_old(rl, sd, -1);

1 0

[tor/maint-0.2.8] Fix a double-free bug in routerlist_reparse_old
by nickm＠torproject.org 25 May '16

25 May '16

commit 9cf6af76eb250dc0716185e349a92b2def6981d3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 25 11:52:52 2016 -0400 Fix a double-free bug in routerlist_reparse_old I introduced this bug when I moved signing_key_cert into signed_descriptor_t. Bug not in any released Tor. Fixes bug 19175, and another case of 19128. Just like signed_descriptor_from_routerinfo(), routerlist_reparse_old() copies the fields from one signed_descriptor_t to another, and then clears the fields from the original that would have been double-freed by freeing the original. But when I fixed the s_d_f_r() bug [#19128] in 50cbf220994c7cec593, I missed the fact that the code was duplicated in r_p_o(). Duplicated code strikes again! For a longer-term solution here, I am not only adding the missing fix to r_p_o(): I am also extracting the duplicated code into a new function. Many thanks to toralf for patiently sending me stack traces until one made sense. --- src/or/routerlist.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index d49814f..a08b5f3 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -2938,6 +2938,19 @@ signed_descriptor_free(signed_descriptor_t *sd) tor_free(sd); } +/** Copy src into dest, and steal all references inside src so that when + * we free src, we don't mess up dest. */ +static void +signed_descriptor_move(signed_descriptor_t *dest, + signed_descriptor_t *src) +{ + tor_assert(dest != src); + memcpy(dest, src, sizeof(signed_descriptor_t)); + src->signed_descriptor_body = NULL; + src->signing_key_cert = NULL; + dest->routerlist_index = -1; +} + /** Extract a signed_descriptor_t from a general routerinfo, and free the * routerinfo. */ @@ -2947,10 +2960,7 @@ signed_descriptor_from_routerinfo(routerinfo_t *ri) signed_descriptor_t *sd; tor_assert(ri->purpose == ROUTER_PURPOSE_GENERAL); sd = tor_malloc_zero(sizeof(signed_descriptor_t)); - memcpy(sd, &(ri->cache_info), sizeof(signed_descriptor_t)); - sd->routerlist_index = -1; - ri->cache_info.signed_descriptor_body = NULL; - ri->cache_info.signing_key_cert = NULL; + signed_descriptor_move(sd, &ri->cache_info); routerinfo_free(ri); return sd; } @@ -3436,9 +3446,7 @@ routerlist_reparse_old(routerlist_t *rl, signed_descriptor_t *sd) 0, 1, NULL, NULL); if (!ri) return NULL; - memcpy(&ri->cache_info, sd, sizeof(signed_descriptor_t)); - sd->signed_descriptor_body = NULL; /* Steal reference. */ - ri->cache_info.routerlist_index = -1; + signed_descriptor_move(&ri->cache_info, sd); routerlist_remove_old(rl, sd, -1);

1 0

[tor/maint-0.2.8] Merge branch 'bug19175_028_v2' into maint-0.2.8
by nickm＠torproject.org 25 May '16

25 May '16

commit f2d614c3d93aceac4954f7cd593213a5fcfbb123 Merge: 6d375f1 9cf6af7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 25 16:12:01 2016 -0400 Merge branch 'bug19175_028_v2' into maint-0.2.8 src/or/routerlist.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)

1 0

[tor/master] Merge branch 'bug19175_028_v2' into maint-0.2.8
by nickm＠torproject.org 25 May '16

25 May '16

commit f2d614c3d93aceac4954f7cd593213a5fcfbb123 Merge: 6d375f1 9cf6af7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 25 16:12:01 2016 -0400 Merge branch 'bug19175_028_v2' into maint-0.2.8 src/or/routerlist.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)

1 0

[tor/release-0.2.8] Fold new entries into 0.2.8.3-alpha changelog.
by nickm＠torproject.org 25 May '16

25 May '16

commit 693e48a5a4dc0bd537e00134606268b6b91afce0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 25 10:29:15 2016 -0400 Fold new entries into 0.2.8.3-alpha changelog. --- ChangeLog | 22 +++++++++++++++++++++- changes/bug19161 | 3 --- changes/memarea_overflow | 7 ------- changes/rsa_init_bug | 7 ------- 4 files changed, 21 insertions(+), 18 deletions(-) diff --git a/ChangeLog b/ChangeLog index c2c2821..04794e5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,4 @@ -Changes in version 0.2.8.3-alpha - 2016-05-?? +Changes in version 0.2.8.3-alpha - 2016-05-2? Tor 0.2.8.3-alpha resolves several bugs, most of them introduced over the course of the 0.2.8 development cycle. It improves the behavior of directory clients, fixes several crash bugs, fixes a gap in compiler @@ -51,6 +51,15 @@ Changes in version 0.2.8.3-alpha - 2016-05-?? IPv6 bridges. Fixes bug 18921; bugfix on 0.2.8.1-alpha. Patch by "teor". + o Major bugfixes (key management): + - If OpenSSL fails to generate an RSA key, do not retain a dangling + pointer to the previous (uninitialized) key value. The impact here + should be limited to a difficult-to-trigger crash, if OpenSSL is + running an engine that makes key generation failures possible, or + if OpenSSL runs out of memory. Fixes bug 19152; bugfix on + 0.2.1.10-alpha. Found by Yuan Jochen Kang, Suman Jana, and + Baishakhi Ray. + o Major bugfixes (testing): - Fix a bug that would block 'make test-network-all' on systems where IPv6 packets were lost. Fixes bug 19008; bugfix on tor-0.2.7.3-rc. @@ -89,6 +98,9 @@ Changes in version 0.2.8.3-alpha - 2016-05-?? - Resolve warnings when building on systems that are concerned with signed char. Fixes bug 18728; bugfix on 0.2.7.2-alpha and 0.2.6.1-alpha. + - When libscrypt.h is found, but no libscrypt library can be linked, + treat libscrypt as absent. Fixes bug 19161; bugfix + on 0.2.6.1-alpha. o Minor bugfixes (client): - Turn all TestingClientBootstrap* into non-testing torrc options. @@ -134,6 +146,14 @@ Changes in version 0.2.8.3-alpha - 2016-05-?? to terminate a pluggable transport because it has already exited. Fixes bug 18686; bugfix on 0.2.5.5-alpha. + o Minor bugfixes (pointer arithmetic): + - Fix a bug in memarea_alloc() that could have resulted in remote + heap write access, if Tor had ever passed an unchecked size to + memarea_alloc(). Fortunately, all the sizes we pass to + memarea_alloc() are pre-checked to be less than 128 kilobytes. + Fixes bug 19150; bugfix on 0.2.1.1-alpha. Bug found by + Guido Vranken. + o Minor bugfixes (relays): - Consider more config options when relays decide whether to regenerate their descriptor. Fixes more of bug 12538; bugfix diff --git a/changes/bug19161 b/changes/bug19161 deleted file mode 100644 index 78c2165..0000000 --- a/changes/bug19161 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor bugfixes (compilation): - - When libscrypt.h is found, but no libscrypt library can be linked, - treat libscrypt as absent. Fixes bug 19161; bugfix on 0.2.6.1-alpha. diff --git a/changes/memarea_overflow b/changes/memarea_overflow deleted file mode 100644 index 8fdc38c..0000000 --- a/changes/memarea_overflow +++ /dev/null @@ -1,7 +0,0 @@ - o Minor bugfixes (pointer arithmetic): - - Fix a bug in memarea_alloc() that could have resulted in remote heap - write access, if Tor had ever passed an unchecked size to - memarea_alloc(). Fortunately, all the sizes we pass to memarea_alloc() - are pre-checked to be less than 128 kilobytes. Fixes bug 19150; bugfix - on 0.2.1.1-alpha. Bug found by Guido Vranken. - diff --git a/changes/rsa_init_bug b/changes/rsa_init_bug deleted file mode 100644 index 6b5fb4f..0000000 --- a/changes/rsa_init_bug +++ /dev/null @@ -1,7 +0,0 @@ - o Major bugfixes (key management): - - If OpenSSL fails to generate an RSA key, do not retain a dangling pointer - to the previous (uninitialized) key value. The impact here should be - limited to a difficult-to-trigger crash, if OpenSSL is running an - engine that makes key generation failures possible, or if OpenSSL runs - out of memory. Fixes bug 19152; bugfix on 0.2.1.10-alpha. Found by - Yuan Jochen Kang, Suman Jana, and Baishakhi Ray.

1 0