- tor-commits - lists.torproject.org

[tor/master] Fix a coverity NULL-pointer deref warning in the tortls tests.
by nickm＠torproject.org 18 Dec '15

18 Dec '15

commit 6b5b1a02d46f761b691527c8e3c9a2ad08b0c3a5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 18 10:25:15 2015 -0500 Fix a coverity NULL-pointer deref warning in the tortls tests. Also, make our cert validation code more NULL-resistant. This is CID 1327891. --- src/common/tortls.c | 2 +- src/test/test_tortls.c | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index a1facec..5e0c970 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -884,7 +884,7 @@ tor_tls_cert_is_valid(int severity, EVP_PKEY *cert_key; int r, key_ok = 0; - if (!signing_cert) + if (!signing_cert || !cert) goto bad; EVP_PKEY *signing_key = X509_get_pubkey(signing_cert->cert); diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index 709c8db..add020e 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -2680,7 +2680,12 @@ test_tortls_cert_is_valid(void *ignored) scert = tor_malloc_zero(sizeof(tor_x509_cert_t)); ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0); tt_int_op(ret, OP_EQ, 0); + + cert = tor_malloc_zero(sizeof(tor_x509_cert_t)); + ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0); + tt_int_op(ret, OP_EQ, 0); tor_free(scert); + tor_free(cert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString));

1 0

[tor/master] Fix a coverity NULL-pointer deref warning in the DNS tests.
by nickm＠torproject.org 18 Dec '15

18 Dec '15

commit 428e2b7636ed2430dd41d3a802290e971d2a081a Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 18 10:27:30 2015 -0500 Fix a coverity NULL-pointer deref warning in the DNS tests. This is CID 1340251 --- src/test/test_dns.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/test/test_dns.c b/src/test/test_dns.c index b781d6d..6fdbe90 100644 --- a/src/test/test_dns.c +++ b/src/test/test_dns.c @@ -738,7 +738,8 @@ NS(test_main)(void *arg) NS_UNMOCK(launch_resolve); tor_free(on_circ); tor_free(TO_CONN(exitconn)->address); - tor_free(cache_entry->pending_connections); + if (cache_entry) + tor_free(cache_entry->pending_connections); tor_free(cache_entry); tor_free(exitconn); return;

1 0

[tor/master] Fix a coverity uninitialized-pointer warning in policy tests.
by nickm＠torproject.org 18 Dec '15

18 Dec '15

commit 498897e33d1e32054f0c5cd23f8f0850785733db Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 18 10:29:27 2015 -0500 Fix a coverity uninitialized-pointer warning in policy tests. This is CID 1340255 --- src/test/test_policy.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/test/test_policy.c b/src/test/test_policy.c index 4f5565e..794978f 100644 --- a/src/test/test_policy.c +++ b/src/test/test_policy.c @@ -1021,6 +1021,8 @@ test_policies_getinfo_helper_policies(void *arg) const char *errmsg = NULL; routerinfo_t mock_my_routerinfo; + memset(&mock_my_routerinfo, 0, sizeof(mock_my_routerinfo)); + rv = getinfo_helper_policies(NULL, "exit-policy/default", &answer, &errmsg); tt_assert(rv == 0); tt_assert(answer != NULL);

1 0

[tor/master] Fix a buffer overrun in connection tests.
by nickm＠torproject.org 18 Dec '15

18 Dec '15

commit 9b1c491ec602c936ca9d75e1e55bddbb95056fee Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 18 10:32:50 2015 -0500 Fix a buffer overrun in connection tests. This is CID 1343601. --- src/test/test_connection.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/test/test_connection.c b/src/test/test_connection.c index f6e08fd..dab6f2b 100644 --- a/src/test/test_connection.c +++ b/src/test/test_connection.c @@ -231,9 +231,10 @@ test_conn_get_rend_setup(const struct testcase_t *tc) /* TODO: use directory_initiate_command_rend() to do this - maybe? */ conn->rend_data = tor_malloc_zero(sizeof(rend_data_t)); + tor_assert(strlen(TEST_CONN_REND_ADDR) == REND_SERVICE_ID_LEN_BASE32); memcpy(conn->rend_data->onion_address, TEST_CONN_REND_ADDR, - REND_SERVICE_ADDRESS_LEN+1); + REND_SERVICE_ID_LEN_BASE32+1); conn->rend_data->hsdirs_fp = smartlist_new(); conn->base_.purpose = TEST_CONN_REND_PURPOSE;

1 0

[tor/master] Fix an unreached null-pointer deref in connection tests
by nickm＠torproject.org 18 Dec '15

18 Dec '15

commit 4ede2decadca1decb5f6755c6d65a459d4d09c95 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 18 10:35:25 2015 -0500 Fix an unreached null-pointer deref in connection tests This is CID 1343603 --- src/test/test_connection.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/test/test_connection.c b/src/test/test_connection.c index dab6f2b..c5ef929 100644 --- a/src/test/test_connection.c +++ b/src/test/test_connection.c @@ -182,14 +182,13 @@ test_conn_get_basic_teardown(const struct testcase_t *tc, void *arg) conn->linked_conn->write_event = NULL; } - connection_free(conn->linked_conn); - conn->linked_conn = NULL; - - conn->linked_conn->linked_conn = NULL; if (!conn->linked_conn->marked_for_close) { connection_close_immediate(conn->linked_conn); connection_mark_for_close(conn->linked_conn); } + conn->linked_conn->linked_conn = NULL; + connection_free(conn->linked_conn); + conn->linked_conn = NULL; } /* We didn't set the events up properly, so we can't use event_del() in

1 0

[tor/master] Looks like I added one X509_free too many :(
by nickm＠torproject.org 18 Dec '15

18 Dec '15

commit 2e99371eb9886559814c3c8b7e4ba52e474bb520 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 18 10:20:14 2015 -0500 Looks like I added one X509_free too many :( --- src/test/test_tortls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index 1bb70ad..709c8db 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -1466,11 +1466,11 @@ test_tortls_try_to_extract_certs_from_tls(void *ignored) sk_X509_push(sess->cert_chain, c1); sk_X509_push(sess->cert_chain, c2); + try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert); tt_assert(cert == c1); tt_assert(id_cert); X509_free(cert); /* decrease refcnt */ - X509_free(id_cert); /* decrease refcnt */ done: sk_X509_free(sess->cert_chain);

1 0

[tor/master] Fix a null-pointer deref when writing geoip stats
by nickm＠torproject.org 18 Dec '15

18 Dec '15

commit 4604b3ab197af5f6d0d407bd2dbe4b0d6a14e22b Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 18 10:00:44 2015 -0500 Fix a null-pointer deref when writing geoip stats Found by coverity; CID 1327892. --- src/or/geoip.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/or/geoip.c b/src/or/geoip.c index 3ef1672..26030ae 100644 --- a/src/or/geoip.c +++ b/src/or/geoip.c @@ -1279,6 +1279,8 @@ geoip_dirreq_stats_write(time_t now) /* Generate history string .*/ str = geoip_format_dirreq_stats(now); + if (! str) + goto done; /* Write dirreq-stats string to disk. */ if (!check_or_create_data_subdir("stats")) {

1 0

[tor/master] Fix some dead code in tortls.c
by nickm＠torproject.org 18 Dec '15

18 Dec '15

commit 9e2c4ee557a499a0fa6b12f5912cef4fccc46e5a Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 18 10:04:01 2015 -0500 Fix some dead code in tortls.c If SSL_CIPHER_find exists, then we won't use either of the two kludges that would replace it. Found by Coverity; fixes CID 1340256. --- src/common/tortls.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index b1d3f6f..a1facec 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1322,7 +1322,8 @@ find_cipher_by_id(const SSL *ssl, const SSL_METHOD *m, uint16_t cipher) tor_assert((SSL_CIPHER_get_id(c) & 0xffff) == cipher); return c != NULL; } -#elif defined(HAVE_STRUCT_SSL_METHOD_ST_GET_CIPHER_BY_CHAR) +#else +#if defined(HAVE_STRUCT_SSL_METHOD_ST_GET_CIPHER_BY_CHAR) if (m && m->get_cipher_by_char) { unsigned char cipherid[3]; set_uint16(cipherid, htons(cipher)); @@ -1333,7 +1334,7 @@ find_cipher_by_id(const SSL *ssl, const SSL_METHOD *m, uint16_t cipher) if (c) tor_assert((c->id & 0xffff) == cipher); return c != NULL; - } else + } #endif #if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,1,0) if (m && m->get_cipher && m->num_ciphers) { @@ -1351,6 +1352,7 @@ find_cipher_by_id(const SSL *ssl, const SSL_METHOD *m, uint16_t cipher) return 0; } #endif +#endif (void) ssl; (void) m; (void) cipher;

1 0

[tor/master] Fix remaining memory leaks in unit tests.
by nickm＠torproject.org 18 Dec '15

18 Dec '15

commit 2e74d182b2a10a32efd7203e9e430d9b431397c8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 18 09:58:14 2015 -0500 Fix remaining memory leaks in unit tests. --- src/test/test_tortls.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index 8602d9e..1bb70ad 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -1128,7 +1128,9 @@ test_tortls_check_lifetime(void *ignored) ret = tor_tls_check_lifetime(LOG_WARN, tls, 0, 0); tt_int_op(ret, OP_EQ, 0); + ASN1_STRING_free(validCert->cert_info->validity->notBefore); validCert->cert_info->validity->notBefore = ASN1_TIME_set(NULL, now-10); + ASN1_STRING_free(validCert->cert_info->validity->notAfter); validCert->cert_info->validity->notAfter = ASN1_TIME_set(NULL, now+60); ret = tor_tls_check_lifetime(LOG_WARN, tls, 0, -1000); @@ -1454,17 +1456,21 @@ test_tortls_try_to_extract_certs_from_tls(void *ignored) try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert); tt_assert(cert == c1); tt_assert(!id_cert); + X509_free(cert); /* decrease refcnt */ sess->cert_chain = sk_X509_new_null(); try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert); tt_assert(cert == c1); tt_assert(!id_cert); + X509_free(cert); /* decrease refcnt */ sk_X509_push(sess->cert_chain, c1); sk_X509_push(sess->cert_chain, c2); try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert); tt_assert(cert == c1); tt_assert(id_cert); + X509_free(cert); /* decrease refcnt */ + X509_free(id_cert); /* decrease refcnt */ done: sk_X509_free(sess->cert_chain); @@ -1472,6 +1478,8 @@ test_tortls_try_to_extract_certs_from_tls(void *ignored) tor_free(tls->ssl->session); tor_free(tls->ssl); tor_free(tls); + X509_free(c1); + X509_free(c2); } #endif

1 0

[tor/master] Add zlib path when linking the switch_id test
by nickm＠torproject.org 18 Dec '15

18 Dec '15

commit 6598581d8163516f4879f5cb3c563dae10de80d1 Author: cypherpunks <cypherpunks(a)torproject.org> Date: Fri Dec 18 10:04:06 2015 +0100 Add zlib path when linking the switch_id test --- src/test/include.am | 1 + 1 file changed, 1 insertion(+) diff --git a/src/test/include.am b/src/test/include.am index d52867b..a6663dc 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -143,6 +143,7 @@ src_test_test_switch_id_SOURCES = \ src/test/test_switch_id.c src_test_test_switch_id_CPPFLAGS= $(src_test_AM_CPPFLAGS) src_test_test_switch_id_CFLAGS = $(AM_CFLAGS) $(TEST_CFLAGS) +src_test_test_switch_id_LDFLAGS = @TOR_LDFLAGS_zlib@ src_test_test_switch_id_LDADD = \ src/common/libor-testing.a \ @TOR_ZLIB_LIBS@ @TOR_LIB_MATH@

1 0