tor/changes/memarea_overflow

  o Minor bugfixes (pointer arithmetic):
    - Fix a bug in memarea_alloc() that could have resulted in remote heap
      write access, if Tor had ever passed an unchecked size to
      memarea_alloc().  Fortunately, all the sizes we pass to memarea_alloc()
      are pre-checked to be less than 128 kilobytes. Fixes bug 19150; bugfix
      on 0.2.1.1-alpha. Bug found by Guido Vranken.
Fix a pointer arithmetic bug in memarea_alloc() Fortunately, the arithmetic cannot actually overflow, so long as we always check for the size of potentially hostile input before copying it. I think we do, though. We do check each line against MAX_LINE_LENGTH, and each object name or object against MAX_UNPARSED_OBJECT_SIZE, both of which are 128k. So to get this overflow, we need to have our memarea allocated way way too high up in RAM, which most allocators won't actually do. Bugfix on 0.2.1.1-alpha, where memarea was introduced. Found by Guido Vranken. 2016-05-19 16:52:27 +02:00			`o Minor bugfixes (pointer arithmetic):`
			`- Fix a bug in memarea_alloc() that could have resulted in remote heap`
			`write access, if Tor had ever passed an unchecked size to`
			`memarea_alloc(). Fortunately, all the sizes we pass to memarea_alloc()`
			`are pre-checked to be less than 128 kilobytes. Fixes bug 19150; bugfix`
			`on 0.2.1.1-alpha. Bug found by Guido Vranken.`