[tor-bugs] #19032 [Core Tor/Tor]: Out of bounds write on directory authorities when voting on duplicate ed25519 keys

[Tor Bug Tracker & Wiki]

#19032: Out of bounds write on directory authorities when voting on duplicate
ed25519 keys
------------------------------+--------------------------------
     Reporter:  special       |      Owner:
         Type:  defect        |     Status:  new
     Priority:  Immediate     |  Milestone:  Tor: 0.2.7.x-final
    Component:  Core Tor/Tor  |    Version:
     Severity:  Critical      |   Keywords:
Actual Points:                |  Parent ID:
       Points:                |   Reviewer:
      Sponsor:                |
------------------------------+--------------------------------
 In dirserv_compute_performance_thresholds, we allocate arrays based on the
 length of 'routers', a list of routerinfo_t, but loop over the nodelist.
 The 'routers' list may be shorter when relays were filtered by
 routers_make_ed_keys_unique, leading to an out-of-bounds write.

 This bug was originally introduced in 26e89742, but it doesn't look
 possible to trigger until routers_make_ed_keys_unique was introduced in
 13a31e72.

 This needs a backport to 0.2.7, but wasn't in a released version. Fix on
 0.2.8.2-alpha.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19032>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online