[tor-bugs] #7729 [Tor]: Reading pending TLS bytes can take us over at_most

[Tor Bug Tracker & Wiki]

#7729: Reading pending TLS bytes can take us over at_most
-----------------------+----------------------------------------------------
 Reporter:  nickm      |          Owner:                    
     Type:  defect     |         Status:  needs_review      
 Priority:  normal     |      Milestone:  Tor: 0.2.4.x-final
Component:  Tor        |        Version:                    
 Keywords:  tor-relay  |         Parent:                    
   Points:             |   Actualpoints:                    
-----------------------+----------------------------------------------------
Changes (by nickm):

  * status:  new => needs_review


Comment:

 The patch might be a little more simply written, given that the value of
 more_to_read is about to get replaced as soon as we do the "goto again".

 Perhaps we could just do:
 {{{
 -  if (more_to_read && result == at_most) {
 +  if (more_to_read && result >= at_most &&
 +      more_to_read > (size_t)(result - at_most)) {
      slack_in_buf = buf_slack(conn->inbuf);
 -    at_most = more_to_read;
 +    at_most = more_to_read - (result - at_most);
      goto again;
    }
 }}}

 or have the code be:
 {{{
   {
     ssize_t tmp;
     if (more_to_read && result >= at_most &&
         (tmp = more_to_read - (result - at_most)) > 0) {
       slack_in_buf = buf_slack(conn->inbuf);
       at_most = tmp;
       goto again;
     }
   }
 }}}

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/7729#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online