nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-30 23:53:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Try to check for (and prevent) buffer size INT_MAX overflow better.

Browse Source 
Possible fix or diagnostic for 21369.
This commit is contained in:
Nick Mathewson 2017-02-13 15:51:55 -05:00
parent 67cec7578c
commit ee5471f9aa
2 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
changes/bug21369_check Normal file
View File

@ -0,0 +1,3 @@
o Minor features (reliability, crash):
- Try better to detect problems in buffers where they might grow (or
think they have grown) over 2 GB in size. Diagnostic for bug 21369.

21
src/or/buffers.c
View File

@ -562,6 +562,11 @@ read_to_buf(tor_socket_t s, size_t at_most, buf_t *buf, int *reached_eof,
tor_assert(reached_eof); tor_assert(reached_eof);
tor_assert(SOCKET_OK(s)); tor_assert(SOCKET_OK(s));
if (BUG(buf->datalen >= INT_MAX))
return -1;
if (BUG(buf->datalen >= INT_MAX - at_most))
return -1;
while (at_most > total_read) { while (at_most > total_read) {
size_t readlen = at_most - total_read; size_t readlen = at_most - total_read;
chunk_t *chunk; chunk_t *chunk;
@ -619,6 +624,11 @@ read_to_buf_tls(tor_tls_t *tls, size_t at_most, buf_t *buf)
check(); check();
if (BUG(buf->datalen >= INT_MAX))
return -1;
if (BUG(buf->datalen >= INT_MAX - at_most))
return -1;
while (at_most > total_read) { while (at_most > total_read) {
size_t readlen = at_most - total_read; size_t readlen = at_most - total_read;
chunk_t *chunk; chunk_t *chunk;
@ -813,6 +823,11 @@ write_to_buf(const char *string, size_t string_len, buf_t *buf)
return (int)buf->datalen; return (int)buf->datalen;
check(); check();
if (BUG(buf->datalen >= INT_MAX))
return -1;
if (BUG(buf->datalen >= INT_MAX - string_len))
return -1;
while (string_len) { while (string_len) {
size_t copy; size_t copy;
if (!buf->tail || !CHUNK_REMAINING_CAPACITY(buf->tail)) if (!buf->tail || !CHUNK_REMAINING_CAPACITY(buf->tail))
@ -962,6 +977,12 @@ move_buf_to_buf(buf_t *buf_out, buf_t *buf_in, size_t *buf_flushlen)
/* We can do way better here, but this doesn't turn up in any profiles. */ /* We can do way better here, but this doesn't turn up in any profiles. */
char b[4096]; char b[4096];
size_t cp, len; size_t cp, len;
if (BUG(buf_out->datalen >= INT_MAX))
return -1;
if (BUG(buf_out->datalen >= INT_MAX - *buf_flushlen))
return -1;
len = *buf_flushlen; len = *buf_flushlen;
if (len > buf_in->datalen) if (len > buf_in->datalen)
len = buf_in->datalen; len = buf_in->datalen;