nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-02 16:43:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'tor-github/pr/1178' into maint-0.2.9

Browse Source
This commit is contained in:
teor 2019-10-23 08:20:45 +10:00
commit 7660a7cf7d
No known key found for this signature in database
GPG Key ID: 10FEAA0E7075672A
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
changes/ticket31001 Normal file
View File

@ -0,0 +1,6 @@
o Minor bugfixes (compatibility, standards compliance):
- Fix a bug that would invoke undefined behavior on certain operating
systems when trying to asprintf() a string exactly INT_MAX bytes
long. We don't believe this is exploitable, but it's better
to fix it anyway. Fixes bug 31001; bugfix on 0.2.2.11-alpha.
Found and fixed by Tobias Stoeckmann.

8
src/common/compat.c
View File

@ -542,8 +542,8 @@ tor_vasprintf(char **strp, const char *fmt, va_list args)
*strp = NULL; *strp = NULL;
return -1; return -1;
} }
strp_tmp = tor_malloc(len + 1); strp_tmp = tor_malloc((size_t)len + 1);
r = _vsnprintf(strp_tmp, len+1, fmt, args); r = _vsnprintf(strp_tmp, (size_t)len+1, fmt, args);
if (r != len) { if (r != len) {
tor_free(strp_tmp); tor_free(strp_tmp);
*strp = NULL; *strp = NULL;
@ -578,9 +578,9 @@ tor_vasprintf(char **strp, const char *fmt, va_list args)
*strp = tor_strdup(buf); *strp = tor_strdup(buf);
return len; return len;
} }
strp_tmp = tor_malloc(len+1); strp_tmp = tor_malloc((size_t)len+1);
/* use of tor_vsnprintf() will ensure string is null terminated */ /* use of tor_vsnprintf() will ensure string is null terminated */
r = tor_vsnprintf(strp_tmp, len+1, fmt, args); r = tor_vsnprintf(strp_tmp, (size_t)len+1, fmt, args);
if (r != len) { if (r != len) {
tor_free(strp_tmp); tor_free(strp_tmp);
*strp = NULL; *strp = NULL;