[tor-bugs] #9200 [Tor]: named_flag[v_sl_idx] check when computing chosen_name in dirvote.c is wrong

[Tor Bug Tracker & Wiki]

#9200: named_flag[v_sl_idx] check when computing chosen_name in dirvote.c is wrong
----------------------+-----------------------------------------------------
 Reporter:  nickm     |          Owner:                    
     Type:  defect    |         Status:  new               
 Priority:  major     |      Milestone:  Tor: 0.2.4.x-final
Component:  Tor       |        Version:                    
 Keywords:  tor-auth  |         Parent:                    
   Points:            |   Actualpoints:                    
----------------------+-----------------------------------------------------
 When we look to see whether the Named flag is set on a vote, we do:
 {{{
    rs->flags & (U64_LITERAL(1) << named_flag[v_sl_idx])
 }}}
 without checking whether named_flag[v_sl_idx] is >= 0.  This can invoke
 undefined behavior!

 Now, in practice, on x86 chips with gcc or clang, assuming no excessive
 compiler cleverness, this is probably just going to result in a check of
 bit 63, which won't be in use unless the directory authority has listed 63
 flag.  So it won't break the voting algorithm so long as all directories
 are honest.

 But all-honest directories is ''not'' our assumption, so this should get
 fixed in the next release.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9200>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online