[tor-bugs] #29527 [Core Tor/Tor]: Division by zero: undefined behaviour in circuitpadding/circuitpadding_sample_distribution test

[Tor Bug Tracker & Wiki]

#29527: Division by zero: undefined behaviour in
circuitpadding/circuitpadding_sample_distribution test
-------------------------------------------------+-------------------------
 Reporter:  teor                                 |          Owner:  (none)
     Type:  defect                               |         Status:  new
 Priority:  High                                 |      Milestone:  Tor:
                                                 |  0.4.0.x-final
Component:  Core Tor/Tor                         |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  regression, tor-ci, tor-test,        |  Actual Points:
  040-must                                       |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by riastradh):

 test_circuitpadding.c, helper_circpad_circ_distribution_machine_setup has
 the following comment:

 {{{
 /** Helper function: Initializes a padding machine where every state uses
 the
  *  uniform probability distribution.  */
 }}}

 However, it proceeds to set up several other distributions with
 nonsensical and/or ignored parameters:

 {{{
   zero_st->iat_dist.type = CIRCPAD_DIST_UNIFORM;
   zero_st->iat_dist.param1 = min;
   zero_st->iat_dist.param2 = max;
 ...
   first_st->iat_dist.type = CIRCPAD_DIST_LOGISTIC;
   first_st->iat_dist.param1 = min;
   first_st->iat_dist.param2 = max;
 ...
   second_st->iat_dist.type = CIRCPAD_DIST_LOG_LOGISTIC;
   second_st->iat_dist.param1 = min;
   second_st->iat_dist.param2 = max;
 ...
   third_st->iat_dist.type = CIRCPAD_DIST_GEOMETRIC;
   third_st->iat_dist.param1 = min;
   third_st->iat_dist.param2 = max;
 ...
   fourth_st->iat_dist.type = CIRCPAD_DIST_WEIBULL;
   fourth_st->iat_dist.param1 = min;
   fourth_st->iat_dist.param2 = max;
 ...
   fifth_st->iat_dist.type = CIRCPAD_DIST_PARETO;
   fifth_st->iat_dist.param1 = min;
   fifth_st->iat_dist.param2 = max;
 }}}

 Is this intended?  (Here min=0 and max=10 in the solitary call site, which
 might explain the geometric and Weibull distributions with zero
 parameters.)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/29527#comment:8>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online