[tor-commits] [tor/master] Don't use any asserts(), even raw, in format_number_sigsafe().

[nickm at torproject.org]

commit c86850c4c9e8154fdd6e0be53f455a573df17155
Author: Nick Mathewson <nickm at torproject.org>
Date:   Wed Jun 20 16:11:09 2018 -0400

    Don't use any asserts(), even raw, in format_number_sigsafe().
    
    Also explain why.
---
 src/common/torerr.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/common/torerr.c b/src/common/torerr.c
index 5dbdc629a..0e0c4db35 100644
--- a/src/common/torerr.c
+++ b/src/common/torerr.c
@@ -155,8 +155,9 @@ format_number_sigsafe(unsigned long x, char *buf, int buf_len,
   int len;
   char *cp;
 
-  /* NOT tor_assert. This needs to be safe to run from within a signal handler,
-   * and from within the 'tor_assert() has failed' code. */
+  /* NOT tor_assert. This needs to be safe to run from within a signal
+   * handler, and from within the 'tor_assert() has failed' code.  Not even
+   * raw_assert(), since raw_assert() calls this function on failure. */
   if (radix < 2 || radix > 16)
     return 0;
 
@@ -176,7 +177,10 @@ format_number_sigsafe(unsigned long x, char *buf, int buf_len,
   *cp = '\0';
   do {
     unsigned digit = (unsigned) (x % radix);
-    raw_assert(cp > buf);
+    if (cp <= buf) {
+      /* Not tor_assert(); see above. */
+      abort();
+    }
     --cp;
     *cp = "0123456789ABCDEF"[digit];
     x /= radix;