[tor-bugs] #5786 [Tor Directory Authority]: A single authority can crash the other authorities

[Tor Bug Tracker & Wiki]

#5786: A single authority can crash the other authorities
-------------------------------------+--------------------------------------
 Reporter:  asn                      |          Owner:                    
     Type:  defect                   |         Status:  new               
 Priority:  normal                   |      Milestone:  Tor: 0.2.3.x-final
Component:  Tor Directory Authority  |        Version:                    
 Keywords:                           |         Parent:                    
   Points:                           |   Actualpoints:                    
-------------------------------------+--------------------------------------
 boboper found a couple of assertion failures in dirauth vote parsing
 functions:

 {{{
 < boboper> "0 < weight_scale" what a silly style?
 < boboper> lol "weight_scale < INT32_MAX" it's natural bugdoor.
 < boboper> as well as zero compare
 < boboper> good to know you filled your ignore list. I can slowly  develop
 mine exploits. I found that irc helps me to do it better.
 < boboper> "tor_parse_long(eq+1, 10, INT32_MIN, INT32_MAX, &ok, NULL)"
 "tor_assert(ok)" one mad auth can destroy all network. I wanna be auth.
 < boboper> or_parse_long(eq+1, 10, INT32_MIN, INT32_MAX, &ok, NULL); can't
 detect overflow and underflow for 32bit. LONG_MIN == INT32_MIN
 < boboper> "tor_assert(i<n_votes)" you re so funny devs
 }}}

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5786>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online