nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-27 22:03:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix a crash bug in max_u16_in_sl()

Browse Source 
The documentation for this function says that the smartlist can
contain NULLs, but the code only handled NULLs if they were at the
start of the list.

We didn't notice this for a long time, because when Tor is run
normally, the sequence of msg_id_t is densely packed, and so this
list (mapping msg_id_t to channel_id_t) contains no NULL elements.
We could only run into this bug:
  * when Tor was running in embedded mode, and starting more than once.
  * when Tor ran first with more pubsub messages enabled, and then
    later with fewer.
  * When the second run (the one with fewer enabled pubsub messages)
    had at least some messages enabled, and those messages were not
    the ones with numerically highest msg_id_t values.

Fixes bug 31898; bugfix on 47de9c7b0a
in 0.4.1.1-alpha.
This commit is contained in:
Nick Mathewson 2019-10-01 12:55:42 -04:00
parent 34bbdaf5d4
commit 2b825a1a2e
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/bug31898 Normal file
View File

@ -0,0 +1,4 @@
o Major bugfixes (embedded Tor):
- Avoid a possible crash when restarting Tor in embedded mode and
enabling a different set of publish/subscribe messages. Fixes bug
31898; bugfix on 0.4.1.1-alpha.

2
src/lib/dispatch/dispatch_new.c
View File

@ -34,7 +34,7 @@ max_in_u16_sl(const smartlist_t *sl, int dflt)
SMARTLIST_FOREACH_BEGIN(sl, uint16_t *, u) { SMARTLIST_FOREACH_BEGIN(sl, uint16_t *, u) {
if (!maxptr) if (!maxptr)
maxptr = u; maxptr = u;
else if (*u > *maxptr) else if (u && *u > *maxptr)
maxptr = u; maxptr = u;
} SMARTLIST_FOREACH_END(u); } SMARTLIST_FOREACH_END(u);