commit c86850c4c9e8154fdd6e0be53f455a573df17155 Author: Nick Mathewson nickm@torproject.org Date: Wed Jun 20 16:11:09 2018 -0400
Don't use any asserts(), even raw, in format_number_sigsafe().
Also explain why. --- src/common/torerr.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/src/common/torerr.c b/src/common/torerr.c index 5dbdc629a..0e0c4db35 100644 --- a/src/common/torerr.c +++ b/src/common/torerr.c @@ -155,8 +155,9 @@ format_number_sigsafe(unsigned long x, char *buf, int buf_len, int len; char *cp;
- /* NOT tor_assert. This needs to be safe to run from within a signal handler, - * and from within the 'tor_assert() has failed' code. */ + /* NOT tor_assert. This needs to be safe to run from within a signal + * handler, and from within the 'tor_assert() has failed' code. Not even + * raw_assert(), since raw_assert() calls this function on failure. */ if (radix < 2 || radix > 16) return 0;
@@ -176,7 +177,10 @@ format_number_sigsafe(unsigned long x, char *buf, int buf_len, *cp = '\0'; do { unsigned digit = (unsigned) (x % radix); - raw_assert(cp > buf); + if (cp <= buf) { + /* Not tor_assert(); see above. */ + abort(); + } --cp; *cp = "0123456789ABCDEF"[digit]; x /= radix;