tor/changes/ticket29168

  o Major bugfixes (cell scheduler, KIST):
    - Make KIST to always take into account the outbuf length when computing
      what we can actually put in the outbuf. This could lead to the outbuf
      being filled up and thus a possible memory DoS vector. TROVE-2019-001.
      Fixes bug 29168; bugfix on 0.3.2.1-alpha.
kist: Don't write above the highwater outbuf mark KIST works by computing how much should be allowed to write to the kernel for a given socket, and then it writes that amount to the outbuf. The problem is that it could be possible that the outbuf already has lots of data in it from a previous scheduling round (because the kernel is full/busy and Tor was not able to flush the outbuf yet). KIST ignores that the outbuf has been filling (is above its "highwater") and writes more anyway. The end result is that the outbuf length would exceed INT_MAX, hence causing an assertion error and a corresponding "Bug()" message to get printed to the logs. This commit makes it for KIST to take into account the outbuf length when computing the available space. Bug found and patch by Rob Jansen. Closes #29168. TROVE-2019-001. Signed-off-by: David Goulet <dgoulet@torproject.org> 2019-01-24 16:52:08 +01:00			`o Major bugfixes (cell scheduler, KIST):`
			`- Make KIST to always take into account the outbuf length when computing`
			`what we can actually put in the outbuf. This could lead to the outbuf`
			`being filled up and thus a possible memory DoS vector. TROVE-2019-001.`
			`Fixes bug 29168; bugfix on 0.3.2.1-alpha.`