nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 05:03:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

Raise buffer size, fix checks for format_exit_helper_status.

Browse Source 
This is probably not an exploitable bug, since you would need to have
errno be a large negative value in the unix pluggable-transport launcher
case.  Still, best avoided.

Fixes bug 9928; bugfix on 0.2.3.18-rc.
This commit is contained in:
Nick Mathewson 2013-10-08 11:13:21 -04:00
parent b46353b793
commit 17bcfb2604
2 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
changes/bug9928 Normal file
View File

@ -0,0 +1,5 @@
o Minor bugfixes:
- Avoid an off-by-one error when checking buffer boundaries when
formatting the exit status of a pluggable transport helper.
This is probably not an exploitable bug, but better safe than
sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc.

10
src/common/util.c
View File

@ -3256,10 +3256,10 @@ format_hex_number_for_helper_exit_status(unsigned int x, char *buf,
* <b>hex_errno</b>. Called between fork and _exit, so must be signal-handler
* safe.
*
* <b>hex_errno</b> must have at least HEX_ERRNO_SIZE bytes available.
* <b>hex_errno</b> must have at least HEX_ERRNO_SIZE+1 bytes available.
*
* The format of <b>hex_errno</b> is: "CHILD_STATE/ERRNO\n", left-padded
* with spaces. Note that there is no trailing \0. CHILD_STATE indicates where
* with spaces. CHILD_STATE indicates where
* in the processs of starting the child process did the failure occur (see
* CHILD_STATE_* macros for definition), and SAVED_ERRNO is the value of
* errno when the failure occurred.
@ -3338,8 +3338,8 @@ format_helper_exit_status(unsigned char child_state, int saved_errno,
left -= written;
cur += written;
/* Check that we have enough space left for a newline */
if (left <= 0)
/* Check that we have enough space left for a newline and a NUL */
if (left <= 1)
goto err;
/* Emit the newline and NUL */
@ -3594,7 +3594,7 @@ tor_spawn_background(const char *const filename, const char **argv,
this is used for printing out the error message */
unsigned char child_state = CHILD_STATE_INIT;
char hex_errno[HEX_ERRNO_SIZE];
char hex_errno[HEX_ERRNO_SIZE + 1];
static int max_fd = -1;