[tor-bugs] #4230 [Tor Client]: smartlist functions contain bogus overflow checks
Tor Bug Tracker & Wiki
torproject-admin at torproject.org
Wed Nov 9 17:07:12 UTC 2011
#4230: smartlist functions contain bogus overflow checks
------------------------+---------------------------------------------------
Reporter: rransom | Owner:
Type: defect | Status: needs_review
Priority: major | Milestone: Tor: 0.2.1.x-final
Component: Tor Client | Version:
Keywords: | Parent:
Points: | Actualpoints:
------------------------+---------------------------------------------------
Changes (by nickm):
* status: new => needs_review
Comment:
Looking at the patch, I think it's just going to overflow again. Sure, it
caps sl->capacity at INT_MAX, but look at the tor_realloc() call: it
reallocates the buffer to be equal to sizeof(void*)*sl->capacity. So on a
32-bit system, that'll be ((size_t)4)*INT_MAX , which isn't a sensible
thing to say.
Have a look at branch "bug4230" in my public repository; does that look
okay to you?
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4230#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
More information about the tor-bugs
mailing list