[tor-bugs] #20203 [Core Tor/Tor]: tor_assertion_failed on low memory

[Tor Bug Tracker & Wiki]

#20203: tor_assertion_failed on low memory
-------------------------------------------------+-------------------------
 Reporter:  tmpname0901                          |          Owner:
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  High                                 |      Milestone:  Tor:
                                                 |  0.2.9.x-final
Component:  Core Tor/Tor                         |        Version:  Tor:
                                                 |  0.2.8.7
 Severity:  Major                                |     Resolution:
 Keywords:  assert 028-backpoort                 |  Actual Points:  .2
  TorCoreTeam201609                              |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by dgoulet):

 DG1: This seems "dangerous" to me as we pass a possible negative int as an
 unsigned int leading to setting a very large number of cells into the
 cmux:

 {{{
 circuitmux_set_num_cells(cmux, circ, queue->n);
 }}}

 Apart from the above, logic and code looks good to me.

 Although, I'm not really familiar with this subsystem, a review from
 andrea would be desirable.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20203#comment:16>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online