[tor-bugs] #20103 [Core Tor/Tor]: Crash on OpenBSD: tor invoked from Tor Browser 6.0.4

Mon Sep 19 19:56:29 UTC 2016

#20103: Crash on OpenBSD: tor invoked from Tor Browser 6.0.4
-----------------------------------------+---------------------------------
 Reporter:  attila                       |          Owner:
     Type:  defect                       |         Status:  new
 Priority:  High                         |      Milestone:  Tor:
                                         |  0.2.9.x-final
Component:  Core Tor/Tor                 |        Version:  Tor: 0.2.8.7
 Severity:  Normal                       |     Resolution:
 Keywords:  bug regression 028-backport  |  Actual Points:
Parent ID:                               |         Points:
 Reviewer:                               |        Sponsor:
-----------------------------------------+---------------------------------

Comment (by rubiate):

 The same, but different:

 {{{
 ==9107==ERROR: AddressSanitizer: heap-use-after-free on address
 0x60e0004e3b98 at pc 0x7fb130756e46 bp 0x7ffc37f6ce60 sp 0x7ffc37f6ce58
 READ of size 2 at 0x60e0004e3b98 thread T0
     #0 0x7fb130756e45 in tor_addr_family src/common/address.h:155
     #1 0x7fb130756e45 in tor_addr_is_null src/common/address.c:871
     #2 0x7fb130757288 in tor_addr_is_valid src/common/address.c:932
     #3 0x7fb13047dc6b in node_get_all_orports src/or/nodelist.c:836
     #4 0x7fb130734c7a in node_is_a_configured_bridge
 src/or/entrynodes.c:1871
     #5 0x7fb13074173a in any_bridge_supports_microdescriptors
 src/or/entrynodes.c:2487
     #6 0x7fb130468229 in we_use_microdescriptors_for_circuits
 src/or/microdesc.c:924
     #7 0x7fb1304728ec in networkstatus_set_current_consensus
 src/or/networkstatus.c:1680
     #8 0x7fb1306d146c in connection_dir_client_reached_eof
 src/or/directory.c:2009
     #9 0x7fb1306d5cc9 in connection_dir_reached_eof
 src/or/directory.c:2471
     #10 0x7fb13067879e in connection_reached_eof src/or/connection.c:4841
     #11 0x7fb13067879e in connection_handle_read_impl
 src/or/connection.c:3528
     #12 0x7fb130453b67 in conn_read_callback src/or/main.c:803
     #13 0x7fb12e6983db in event_base_loop (/usr/lib/x86_64-linux-
 gnu/libevent-2.0.so.5+0x103db)
     #14 0x7fb130455396 in run_main_loop_once src/or/main.c:2543
     #15 0x7fb130455396 in run_main_loop_until_done src/or/main.c:2589
     #16 0x7fb130455396 in do_main_loop src/or/main.c:2515
     #17 0x7fb13045ab94 in tor_main src/or/main.c:3646
     #18 0x7fb13044865b in main src/or/tor_main.c:30
     #19 0x7fb12cbb9b44 in __libc_start_main (/lib/x86_64-linux-
 gnu/libc.so.6+0x21b44)
     #20 0x7fb13044b01a (tor/src/or/tor+0x56501a)
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20103#comment:18>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online