[tor-bugs] #29168 [Core Tor/Tor]: Fix TROVE-2019-001 (KIST can write above outbuf highwater mark)

[Tor Bug Tracker & Wiki]

#29168: Fix TROVE-2019-001 (KIST can write above outbuf highwater mark)
-------------------------------------------------+-------------------------
 Reporter:  nickm                                |          Owner:  dgoulet
     Type:  defect                               |         Status:  closed
 Priority:  Very High                            |      Milestone:  Tor:
                                                 |  0.4.0.x-final
Component:  Core Tor/Tor                         |        Version:
 Severity:  Normal                               |     Resolution:  fixed
 Keywords:  security, trove, regression,         |  Actual Points:
  040-must                                       |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by nickm):

 For what it's worth, we've only been able to actually make this crash
 occur in a pretty nonstandard testing environment, and only then against
 clients.   But it's entirely possible that there's some way to exploit
 this in the wild that we're missing.  Out of caution, we're giving this
 issue medium severity, and putting out patches: better safe than sorry.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/29168#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online