commit 074f24846321b8d08a8f67c37d72018842274c4e Author: Nick Mathewson nickm@torproject.org Date: Mon Feb 27 09:12:51 2017 -0500

Add one other BUG check to try to fix/solve 21369.

Teor thinks that this connection_dirserv_add_dir_bytes_to_outbuf() might be the problem, if the "remaining" calculation underflows. So I'm adding a couple of checks there, and improving the casts. --- src/or/dirserv.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/or/dirserv.c b/src/or/dirserv.c index fa3938b..fd9d0c7 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -3629,8 +3629,14 @@ connection_dirserv_add_dir_bytes_to_outbuf(dir_connection_t *conn) if (bytes < 8192) bytes = 8192; remaining = conn->cached_dir->dir_z_len - conn->cached_dir_offset; - if (bytes > remaining) + if (BUG(remaining < 0)) { + remaining = 0; + } + if (bytes > remaining) { bytes = (ssize_t) remaining; + if (BUG(bytes < 0)) + return -1; + }

if (conn->zlib_state) { connection_write_to_buf_zlib( @@ -3641,7 +3647,7 @@ connection_dirserv_add_dir_bytes_to_outbuf(dir_connection_t *conn) bytes, TO_CONN(conn)); } conn->cached_dir_offset += bytes; - if (conn->cached_dir_offset == (int)conn->cached_dir->dir_z_len) { + if (conn->cached_dir_offset >= (off_t)conn->cached_dir->dir_z_len) { /* We just wrote the last one; finish up. */ connection_dirserv_finish_spooling(conn); cached_dir_decref(conn->cached_dir);