[tor-bugs] #18162 [Tor]: Potential heap corruption in smartlist_add(), smartlist_insert()

[Tor Bug Tracker & Wiki]

#18162: Potential heap corruption in smartlist_add(), smartlist_insert()
-------------------------------------------------+-------------------------
 Reporter:  asn                                  |          Owner:  nickm
     Type:  defect                               |         Status:
 Priority:  High                                 |  needs_review
Component:  Tor                                  |      Milestone:  Tor:
 Severity:  Normal                               |  0.2.8.x-final
 Keywords:  security 025-backport 026-backport   |        Version:
  027-backport 024-backport                      |     Resolution:
Parent ID:                                       |  Actual Points:
  Sponsor:                                       |         Points:
-------------------------------------------------+-------------------------

Comment (by nickm):

 > This casting approach was preferred over re-defining sl->capacity and
 sl->num_used as size_t. Is this because you would then need to change too
 many things on the rest of the codebase?

 That's right.  In particular, if we cascade the change into
 smartlist_len(), then everything that calls smartlist_len or indexes a
 smartlist gets more complex.   If we only cascade the change throughout
 container.c, it's still a bit ugly.  See for example my branch
 `bug18162_024_alternative` , which I am not currently recommended.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18162#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online