nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 21:23:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'maint-0.4.1'

Browse Source
This commit is contained in:
David Goulet 2019-07-29 12:02:54 -04:00
commit 6dba86d7c9
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
changes/ticket31001 Normal file
View File

@ -0,0 +1,6 @@
o Minor bugfixes (compatibility, standards compliance):
- Fix a bug that would invoke undefined behavior on certain operating
systems when trying to asprintf() a string exactly INT_MAX bytes
long. We don't believe this is exploitable, but it's better
to fix it anyway. Fixes bug 31001; bugfix on 0.2.2.11-alpha.
Found and fixed by Tobias Stoeckmann.

8
src/lib/string/printf.c
View File

@ -117,8 +117,8 @@ tor_vasprintf(char **strp, const char *fmt, va_list args)
*strp = NULL;
return -1;
}
strp_tmp = tor_malloc(len + 1);
r = _vsnprintf(strp_tmp, len+1, fmt, args);
strp_tmp = tor_malloc((size_t)len + 1);
r = _vsnprintf(strp_tmp, (size_t)len+1, fmt, args);
if (r != len) {
tor_free(strp_tmp);
*strp = NULL;
@ -153,9 +153,9 @@ tor_vasprintf(char **strp, const char *fmt, va_list args)
*strp = tor_strdup(buf);
return len;
}
strp_tmp = tor_malloc(len+1);
strp_tmp = tor_malloc((size_t)len+1);
/* use of tor_vsnprintf() will ensure string is null terminated */
r = tor_vsnprintf(strp_tmp, len+1, fmt, args);
r = tor_vsnprintf(strp_tmp, (size_t)len+1, fmt, args);
if (r != len) {
tor_free(strp_tmp);
*strp = NULL;