commit 128ab31c649d3e9ecef284fa3f751dbea13682a6 Author: Nick Mathewson nickm@torproject.org Date: Thu Jun 16 15:36:08 2016 -0400

Mark code unreachable in unescape_string()

Also, add tests for it in case someday it does become reachable. --- src/common/util.c | 14 +++++++++++--- src/test/test_util.c | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/src/common/util.c b/src/common/util.c index 2775dae..a80d96a 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -2823,7 +2823,7 @@ unescape_string(const char *s, char **result, size_t *size_out) if (size_out) *size_out = out - *result; return cp+1; case '\0': - /* LCOV_EXCL_START */ + /* LCOV_EXCL_START -- we caught this in parse_config_from_line. */ tor_fragile_assert(); tor_free(*result); return NULL; @@ -2841,8 +2841,12 @@ unescape_string(const char *s, char **result, size_t *size_out) x1 = hex_decode_digit(cp[2]); x2 = hex_decode_digit(cp[3]); if (x1 == -1 || x2 == -1) { - tor_free(*result); - return NULL; + /* LCOV_EXCL_START */ + /* we caught this above in the initial loop. */ + tor_assert_nonfatal_unreached(); + tor_free(*result); + return NULL; + /* LCOV_EXCL_STOP */ }

*out++ = ((x1<<4) + x2); @@ -2868,7 +2872,11 @@ unescape_string(const char *s, char **result, size_t *size_out) cp += 2; break; default: + /* LCOV_EXCL_START */ + /* we caught this above in the initial loop. */ + tor_assert_nonfatal_unreached(); tor_free(*result); return NULL; + /* LCOV_EXCL_STOP */ } break; default: diff --git a/src/test/test_util.c b/src/test/test_util.c index 55aff31..c3d76c5 100644 --- a/src/test/test_util.c +++ b/src/test/test_util.c @@ -1228,6 +1228,41 @@ test_util_config_line_escaped_content(void *arg) tt_ptr_op(str,OP_EQ, NULL); tor_free(k); tor_free(v);

+ /* more things to try. */ + /* Bad hex: */ + strlcpy(buf1, "Foo "\x9g"\n", sizeof(buf1)); + strlcpy(buf2, "Foo "\xg0"\n", sizeof(buf2)); + strlcpy(buf3, "Foo "\xf"\n", sizeof(buf3)); + /* bad escape */ + strlcpy(buf4, "Foo "\q"\n", sizeof(buf4)); + /* missing endquote */ + strlcpy(buf5, "Foo "hello\n", sizeof(buf5)); + + str=buf1; + str = parse_config_line_from_str(str, &k, &v); + tt_ptr_op(str,OP_EQ, NULL); + tor_free(k); tor_free(v); + + str=buf2; + str = parse_config_line_from_str(str, &k, &v); + tt_ptr_op(str,OP_EQ, NULL); + tor_free(k); tor_free(v); + + str=buf3; + str = parse_config_line_from_str(str, &k, &v); + tt_ptr_op(str,OP_EQ, NULL); + tor_free(k); tor_free(v); + + str=buf4; + str = parse_config_line_from_str(str, &k, &v); + tt_ptr_op(str,OP_EQ, NULL); + tor_free(k); tor_free(v); + + str=buf5; + str = parse_config_line_from_str(str, &k, &v); + tt_ptr_op(str,OP_EQ, NULL); + tor_free(k); tor_free(v); + done: tor_free(k); tor_free(v);