nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 13:13:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'maint-0.2.5' into maint-0.2.6

Browse Source
This commit is contained in:
Nick Mathewson 2016-02-11 12:57:28 -05:00
commit 740421af19
2 changed files with 27 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
changes/bug18162 Normal file
View File

@ -0,0 +1,7 @@
o Major bugfixes (security, pointers):
- Avoid a difficult-to-trigger heap corruption attack when extending
a smartlist to contain over 16GB of pointers. Fixes bug #18162;
bugfix on Tor 0.1.1.11-alpha, which fixed a related bug
incompletely. Reported by Guido Vranken.

37
src/common/container.c
View File

@ -58,31 +58,33 @@ smartlist_clear(smartlist_t *sl)
sl->num_used = 0; sl->num_used = 0;
} }
#if SIZE_MAX < INT_MAX
#error "We don't support systems where size_t is smaller than int."
#endif
/** Make sure that <b>sl</b> can hold at least <b>size</b> entries. */ /** Make sure that <b>sl</b> can hold at least <b>size</b> entries. */
static INLINE void static INLINE void
smartlist_ensure_capacity(smartlist_t *sl, int size) smartlist_ensure_capacity(smartlist_t *sl, size_t size)
{ {
#if SIZEOF_SIZE_T > SIZEOF_INT /* Set MAX_CAPACITY to MIN(INT_MAX, SIZE_MAX / sizeof(void*)) */
#if (SIZE_MAX/SIZEOF_VOID_P) > INT_MAX
#define MAX_CAPACITY (INT_MAX) #define MAX_CAPACITY (INT_MAX)
#else #else
#define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*)))) #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*))))
#define ASSERT_CAPACITY
#endif #endif
if (size > sl->capacity) {
int higher = sl->capacity; tor_assert(size <= MAX_CAPACITY);
if (size > (size_t) sl->capacity) {
size_t higher = (size_t) sl->capacity;
if (PREDICT_UNLIKELY(size > MAX_CAPACITY/2)) { if (PREDICT_UNLIKELY(size > MAX_CAPACITY/2)) {
#ifdef ASSERT_CAPACITY
/* We don't include this assertion when MAX_CAPACITY == INT_MAX,
* since int size; (size <= INT_MAX) makes analysis tools think we're
* doing something stupid. */
tor_assert(size <= MAX_CAPACITY);
#endif
higher = MAX_CAPACITY; higher = MAX_CAPACITY;
} else { } else {
while (size > higher) while (size > higher)
higher *= 2; higher *= 2;
} }
sl->capacity = higher; tor_assert(higher <= INT_MAX); /* Redundant */
sl->capacity = (int) higher;
sl->list = tor_reallocarray(sl->list, sizeof(void *), sl->list = tor_reallocarray(sl->list, sizeof(void *),
((size_t)sl->capacity)); ((size_t)sl->capacity));
} }
@ -94,7 +96,7 @@ smartlist_ensure_capacity(smartlist_t *sl, int size)
void void
smartlist_add(smartlist_t *sl, void *element) smartlist_add(smartlist_t *sl, void *element)
{ {
smartlist_ensure_capacity(sl, sl->num_used+1); smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1);
sl->list[sl->num_used++] = element; sl->list[sl->num_used++] = element;
} }
@ -102,11 +104,12 @@ smartlist_add(smartlist_t *sl, void *element)
void void
smartlist_add_all(smartlist_t *s1, const smartlist_t *s2) smartlist_add_all(smartlist_t *s1, const smartlist_t *s2)
{ {
int new_size = s1->num_used + s2->num_used; size_t new_size = (size_t)s1->num_used + (size_t)s2->num_used;
tor_assert(new_size >= s1->num_used); /* check for overflow. */ tor_assert(new_size >= (size_t) s1->num_used); /* check for overflow. */
smartlist_ensure_capacity(s1, new_size); smartlist_ensure_capacity(s1, new_size);
memcpy(s1->list + s1->num_used, s2->list, s2->num_used*sizeof(void*)); memcpy(s1->list + s1->num_used, s2->list, s2->num_used*sizeof(void*));
s1->num_used = new_size; tor_assert(new_size <= INT_MAX); /* redundant. */
s1->num_used = (int) new_size;
} }
/** Remove all elements E from sl such that E==element. Preserve /** Remove all elements E from sl such that E==element. Preserve
@ -362,7 +365,7 @@ smartlist_insert(smartlist_t *sl, int idx, void *val)
if (idx == sl->num_used) { if (idx == sl->num_used) {
smartlist_add(sl, val); smartlist_add(sl, val);
} else { } else {
smartlist_ensure_capacity(sl, sl->num_used+1); smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1);
/* Move other elements away */ /* Move other elements away */
if (idx < sl->num_used) if (idx < sl->num_used)
memmove(sl->list + idx + 1, sl->list + idx, memmove(sl->list + idx + 1, sl->list + idx,