[tor-bugs] #26284 [Core Tor/Tor]: Out-of-bounds smartlist access in protover_compute_vote()

[Tor Bug Tracker & Wiki]

#26284: Out-of-bounds smartlist access in protover_compute_vote()
------------------------------+--------------------------------
     Reporter:  rl1987        |      Owner:  (none)
         Type:  defect        |     Status:  new
     Priority:  Medium        |  Milestone:  Tor: 0.3.5.x-final
    Component:  Core Tor/Tor  |    Version:  Tor: unspecified
     Severity:  Normal        |   Keywords:
Actual Points:                |  Parent ID:  #26196
       Points:                |   Reviewer:
      Sponsor:                |
------------------------------+--------------------------------
 When compiled with `DEBUG_SMARTLIST`:

 {{{
 dir/v3_networkstatus: [forking] Jun 03 15:26:03.147 [err]
 tor_assertion_failed_: Bug: ./src/common/container.h:70: smartlist_get:
 Assertion sl->num_used > idx failed; aborting. (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.151 [err] Bug: Assertion sl->num_used > idx failed in
 smartlist_get at ./src/common/container.h:70. Stack trace: (on Tor 0.3.4.1
 -alpha-dev b32d8d6025fdc1be)
 Jun 03 15:26:03.151 [err] Bug:     0   test
 0x000000010ffdb108 log_backtrace + 72 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.152 [err] Bug:     1   test
 0x0000000110053771 tor_assertion_failed_ + 385 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.152 [err] Bug:     2   test
 0x000000010fdd9a7a smartlist_get + 490 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.152 [err] Bug:     3   test
 0x000000010fdd8013 protover_compute_vote + 3315 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.153 [err] Bug:     4   test
 0x000000010ff41617 networkstatus_compute_consensus + 8823 (on Tor 0.3.4.1
 -alpha-dev b32d8d6025fdc1be)
 Jun 03 15:26:03.153 [err] Bug:     5   test
 0x000000010f76ac5a test_a_networkstatus + 13930 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.154 [err] Bug:     6   test
 0x000000010fa20684 testcase_run_bare_ + 308 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.154 [err] Bug:     7   test
 0x000000010fa203bc testcase_run_one + 2924 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.154 [err] Bug:     8   test
 0x000000010fa21e31 tinytest_main + 2321 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.155 [err] Bug:     9   test
 0x000000010fa1dffa main + 2218 (on Tor 0.3.4.1-alpha-dev b32d8d6025fdc1be)
 Jun 03 15:26:03.155 [err] Bug:     10  libdyld.dylib
 0x00007fff6619f015 start + 1 (on Tor 0.3.4.1-alpha-dev b32d8d6025fdc1be)
 Jun 03 15:26:03.155 [err] Bug:     11  ???
 0x0000000000000001 0x0 + 1 (on Tor 0.3.4.1-alpha-dev b32d8d6025fdc1be)
 [Lost connection!]
   [v3_networkstatus FAILED]
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26284>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online