[tor-bugs] #31567 [Applications/Tor Browser]: NS_tsnprintf() does not handle %s correctly on Windows

[Tor Bug Tracker & Wiki]

#31567: NS_tsnprintf() does not handle %s correctly on Windows
-------------------------------------------------+-------------------------
 Reporter:  mcs                                  |          Owner:  gk
     Type:  defect                               |         Status:
                                                 |  needs_revision
 Priority:  Very High                            |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Critical                             |     Resolution:
 Keywords:  ff68-esr, tbb-9.0-must-alpha,        |  Actual Points:
  TorBrowserTeam201908                           |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by gk):

 Replying to [comment:29 mcs]:
 > Replying to [comment:28 gk]:
 > > mcs/brade: Oh, and don't let my above comment stop you from debugging
 if you have the time and energy for that. :) Or let me know about some
 shortcuts I could take to figure out what is going on.
 >
 > OK. The thing that does not make sense to me is that on 2019-08-29 Kathy
 and I were able to successfully run an update with our own Windows build
 after we replaced all of the `%s` format specifiers with `%S`. That test
 was interactive (using our own mar file and update server, and with tor-
 browser just patched for our own signing certificate and to use a
 different `app.update.url`). If there was another mingw-w64 bug we should
 have encountered it during that test.

 I see. Well, it could be that Martin's patch opened a new hole while
 closing the previous bug. Or it could still be an issue with my setup. Or
 it could be related to me not using a full update setup but rather just
 your script. However, I somehow doubt the latter at least as using the
 updater executable from 9.0a4 + the newly created .mar file works.
 Additionally, it could be that you replacing the format specifiers killed
 that second, different bug as well. And there are probably some more
 explanations I forgot right now. :) Anyway, I've uploaded both my .exe and
 the signed .mar file I used, so folks can look at that independently from
 me and building own bundles.

 https://people.torproject.org/~gk/testbuilds/31567_3.exe
 https://people.torproject.org/~gk/testbuilds/31567_3.exe.asc

 https://people.torproject.org/~gk/testbuilds/tor-browser-win64-tbb-
 nightly_en-US.mar
 https://people.torproject.org/~gk/testbuilds/tor-browser-win64-tbb-
 nightly_en-US.mar.asc

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31567#comment:30>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online