[tor-bugs] #13018 [Tor Browser]: Math routines are OS fingerprintable

[Tor Bug Tracker & Wiki]

#13018: Math routines are OS fingerprintable
-------------------------+-------------------------------------------------
     Reporter:           |      Owner:  tbb-team
  mikeperry              |     Status:  new
         Type:  defect   |  Milestone:
     Priority:  normal   |    Version:
    Component:  Tor      |   Keywords:  tbb-fingerprinting-os, tbb-easy,
  Browser                |  ff31-esr, TorBrowserTeam201410Easy
   Resolution:           |  Parent ID:
Actual Points:           |
       Points:           |
-------------------------+-------------------------------------------------
Changes (by gk):

 * type:  task => defect


Comment:

 comment:19 was

 More to puzzle. Output of testing sample linked with x86 libm (not
 reproducible for cross compiling):
 {{{
 Before FIX_FPU: tan(-1e300) = -1.421449, tan(strtod('-1e300')) = -4.802497
 After  FIX_FPU: tan(-1e300) = -1.421449, tan(strtod('-1e300')) = 0.883149
 }}}

 Code of sample:
 {{{
 #include <stdio.h>
 #include <stdlib.h>
 #include <math.h>

 inline void FIX_FPU() {
     short control;
     asm("fstcw %0" : "=m" (control) : );
     control &= ~0x300; // Lower bits 8 and 9 (precision control).
     control |= 0x2f3;  // Raise bits 0-5 (exception masks) and 9 (64-bit
 precision).
     asm("fldcw %0" : : "m" (control) );
 }

 int main () {
 char *end;
 double x;

 x = strtod ("-1e300", &end); // eq "x=-1e300";

 printf("Before FIX_FPU: tan(-1e300) = %f, tan(strtod('-1e300')) = %f\n",
 tan(-1e300), tan(x));
 FIX_FPU();
 printf("After  FIX_FPU: tan(-1e300) = %f, tan(strtod('-1e300')) = %f\n",
 tan(-1e300), tan(x));

 return 0;
 }
 }}}
 [https://mxr.mozilla.org/mozilla-esr24/source/js/src/jsnum.cpp#1019
 FIX_FPU]

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13018#comment:20>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online