[tor-bugs] #2326 [Tor Relay]: carefully crafted cache file sizes can trigger assert
Tor Bug Tracker & Wiki
torproject-admin at torproject.org
Wed Dec 29 07:11:00 UTC 2010
#2326: carefully crafted cache file sizes can trigger assert
-----------------------+----------------------------------------------------
Reporter: arma | Owner:
Type: defect | Status: new
Priority: major | Milestone: Tor: 0.2.1.x-final
Component: Tor Relay | Version:
Keywords: | Parent:
-----------------------+----------------------------------------------------
In read_file_to_str() we do
{{{
if ((uint64_t)(statbuf.st_size)+1 > SIZE_T_CEILING)
return NULL;
string = tor_malloc((size_t)(statbuf.st_size+1));
}}}
So a remote attacker who can give you a combination of cached blobs such
that one of your files becomes exactly SIZE_T_CEILING bytes (just 2 gigs
on a 32 bit platform) could cause your Tor to consistently assert on
start.
The fix is to check >= instead of >.
Reported by doors.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2326>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
More information about the tor-bugs
mailing list