[tor-bugs] #17682 [Tor]: safe_timer_diff is unsafe under wrapping

[Tor Bug Tracker & Wiki]

#17682: safe_timer_diff is unsafe under wrapping
-------------------------------------------------+-------------------------
 Reporter:  teor                                 |          Owner:
     Type:  defect                               |         Status:  new
 Priority:  Medium                               |      Milestone:  Tor:
Component:  Tor                                  |  0.2.8.x-final
 Severity:  Normal                               |        Version:  Tor:
 Keywords:  regression, easy, TorCoreTeam201512  |  unspecified
Parent ID:  #17623                               |     Resolution:
  Sponsor:                                       |  Actual Points:
                                                 |         Points:  small
-------------------------------------------------+-------------------------
Changes (by teor):

 * keywords:  regression => regression, easy, TorCoreTeam201512


Comment:

 How to do this patch:
 * check that each value is within a sensible range before subtracting them
 (or adding them)
   * once integer overflow happens in C, it's too late to fix it afterwards
   * remember that INT_MAX - -1 and 0 - INT_MIN both overflow, as does
 anything larger
   * we want to support times less than zero, because the shadow simulator
 uses them
 * write unit tests for edge cases like:
   * safe_timer_diff(INT_MIN, INT_MAX)
   * safe_timer_diff(-1, INT_MAX)
   * safe_timer_diff(0, INT_MAX)
   * safe_timer_diff(1, INT_MAX)
   * safe_timer_diff(INT_MIN, -1)
   * safe_timer_diff(INT_MIN, 0)
   * safe_timer_diff(INT_MIN, 1)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17682#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online