[tor-bugs] #21369 [Core Tor/Tor]: Tor crashes with tor_assertion_failed_() [Assertion buf->datalen < INT_MAX failed in write_to_buf at ../src/or/buffers.c:832]

Thu Feb 9 18:17:12 UTC 2017

#21369: Tor crashes with tor_assertion_failed_() [Assertion buf->datalen < INT_MAX
failed in write_to_buf at ../src/or/buffers.c:832]
--------------------------+------------------------------------
 Reporter:  svengo        |          Owner:
     Type:  defect        |         Status:  new
 Priority:  Very High     |      Milestone:  Tor: 0.3.0.x-final
Component:  Core Tor/Tor  |        Version:  Tor: 0.2.9.9
 Severity:  Critical      |     Resolution:
 Keywords:  029-backport  |  Actual Points:
Parent ID:                |         Points:
 Reviewer:                |        Sponsor:
--------------------------+------------------------------------

Comment (by nickm):

 So, I can only think of two possibilities here:

 1. There was somehow an underflow in buf->datalen, and we subtracted more
 from it than we should have, thus taking it to a large positive value.

 2. There were really 2 gigabytes of data allocated in a single buffer.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21369#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online