[tor-bugs] #29040 [Core Tor/Tor]: Tor crashes if ClientOnionAuthDir contains more than one public key for a hidden service

[Tor Bug Tracker & Wiki]

#29040: Tor crashes if ClientOnionAuthDir contains more than one public key for a
hidden service
--------------------------+------------------------------
 Reporter:  demfloro      |          Owner:  (none)
     Type:  defect        |         Status:  new
 Priority:  Medium        |      Milestone:
Component:  Core Tor/Tor  |        Version:  Tor: 0.3.5.7
 Severity:  Normal        |     Resolution:
 Keywords:                |  Actual Points:
Parent ID:                |         Points:
 Reviewer:                |        Sponsor:
--------------------------+------------------------------

Comment (by demfloro):

 Couldn't attach binary with debug info, so only posting traceback:

 {{{
 Reading symbols from /usr/bin/tor...done.
 [New LWP 763]
 [Thread debugging using libthread_db enabled]
 Using host libthread_db library "/usr/lib/libthread_db.so.1".
 Core was generated by `tor -f /etc/tor/torrc'.
 Program terminated with signal SIGABRT, Aborted.
 #0  0x00007c3c62d21d7f in raise () from /usr/lib/libc.so.6
 (gdb) bt
 #0  0x00007c3c62d21d7f in raise () from /usr/lib/libc.so.6
 #1  0x00007c3c62d0c672 in abort () from /usr/lib/libc.so.6
 #2  0x0000594aa16de1d6 in get_options_mutable () at
 src/app/config/config.c:890
 #3  get_options_mutable () at src/app/config/config.c:887
 #4  0x0000594aa16de552 in get_options () at src/app/config/config.c:1089
 #5  safe_str_client (address=address at entry=0x20 <error: Cannot access
 memory at address 0x20>) at src/app/config/config.c:1089
 #6  0x0000594aa166ae10 in hs_config_client_authorization
 (options=options at entry=0x594aa2021e30,
 validate_only=validate_only at entry=1)
     at src/feature/hs/hs_client.c:1622
 #7  0x0000594aa16fc7f0 in hs_config_client_auth_all
 (options=options at entry=0x594aa2021e30,
 validate_only=validate_only at entry=1)
     at src/feature/hs/hs_config.c:688
 #8  0x0000594aa16e58ab in options_validate
 (old_options=old_options at entry=0x0, options=options at entry=0x594aa2021e30,
     default_options=default_options at entry=0x594aa2023390,
 from_setconf=<optimized out>, from_setconf at entry=0,
 msg=msg at entry=0x7ffc70649498)
     at src/app/config/config.c:4381
 #9  0x0000594aa16e9d34 in options_init_from_string
 (cf_defaults=cf_defaults at entry=0x594aa2021dd0 "",
     cf=cf at entry=0x594aa2018a00 "ClientOnionAuthDir /var/lib/tor/auth\n",
 command=command at entry=0, command_arg=command_arg at entry=0x0,
     msg=msg at entry=0x7ffc70649498) at src/app/config/config.c:5496
 #10 0x0000594aa16ea2f6 in options_init_from_torrc (argc=argc at entry=3,
 argv=argv at entry=0x594aa1ffacd0) at src/app/config/config.c:5272
 #11 0x0000594aa15bf7ba in tor_init (argc=argc at entry=3,
 argv=argv at entry=0x594aa1ffacd0) at src/app/main/main.c:640
 #12 0x0000594aa15c054d in tor_run_main
 (tor_cfg=tor_cfg at entry=0x594aa1ffa290) at src/app/main/main.c:1454
 #13 0x0000594aa15be62b in tor_main (argc=3, argv=0x7ffc70649858) at
 src/feature/api/tor_api.c:164
 #14 0x0000594aa15be1ba in main (argc=<optimized out>, argv=<optimized
 out>) at src/app/main/tor_main.c:32

 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/29040#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online