nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-23 20:03:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

state: Fix segfault on malformed file

Browse Source 
Having no TotalBuildTimes along a positive CircuitBuildAbandonedCount
count lead to a segfault. We check for that condition and then BUG + log
warn if that is the case.

It should never happened in theory but if someone modified their state
file, it can lead to this problem so instead of segfaulting, warn.

Fixes #40437

Signed-off-by: David Goulet <dgoulet@torproject.org>
This commit is contained in:
David Goulet 2023-01-10 09:24:09 -05:00
parent 7e055c383c
commit 4db610d6d9
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/ticket40437 Normal file
View File

@ -0,0 +1,4 @@
o Minor bugfixes (state file):
- Avoid a segfault if the state file doesn't contains TotalBuildTimes along
CircuitBuildAbandonedCount being above 0. Fixes bug 40437; bugfix on
0.3.5.1-alpha.

12
src/core/or/circuitstats.c
View File

@ -1018,6 +1018,18 @@ circuit_build_times_parse_state(circuit_build_times_t *cbt,
return 0;
}
/* We had a case where someone removed their TotalBuildTimes from the state
* files while having CircuitBuildAbandonedCount above 0 leading to a
* segfault (#40437). Simply bug on it and return an error so at least the
* user will learn that they broke the state file. */
if (BUG(state->TotalBuildTimes <= 0 &&
state->CircuitBuildAbandonedCount > 0)) {
log_warn(LD_GENERAL, "CircuitBuildAbandonedCount count is above 0 but "
"no TotalBuildTimes have been found. Unable to "
"parse broken state file");
return -1;
}
/* build_time_t 0 means uninitialized */
loaded_times = tor_calloc(state->TotalBuildTimes, sizeof(build_time_t));