Commit Graph

32288 Commits

Author SHA1 Message Date
Nick Mathewson
b2fc57426c Bump version to 0.4.0.4-rc 2019-04-10 11:51:49 -04:00
Nick Mathewson
98e08b452f Fix pre-commit hook to correctly allow empty changes files.
Fixes bug 30120; bugfix not in any released Tor.
2019-04-10 11:49:23 -04:00
Nick Mathewson
3be1e26b8d Merge branch 'maint-0.4.0' 2019-04-10 11:31:44 -04:00
Nick Mathewson
412bcc5b2a Merge remote-tracking branch 'tor-github/pr/926' into maint-0.4.0 2019-04-10 11:31:33 -04:00
George Kadianakis
2cdc6b2005 Add changes file for #30040. 2019-04-10 12:46:27 +03:00
Tobias Stoeckmann
9ce0bdd226 Prevent double free on huge files with 32 bit.
The function compat_getdelim_ is used for tor_getline if tor is compiled
on a system that lacks getline and getdelim. These systems should be
very rare, considering that getdelim is POSIX.

If this system is further a 32 bit architecture, it is possible to
trigger a double free with huge files.

If bufsiz has been already increased to 2 GB, the next chunk would
be 4 GB in size, which wraps around to 0 due to 32 bit limitations.

A realloc(*buf, 0) could be imagined as "free(*buf); return malloc(0);"
which therefore could return NULL. The code in question considers
that an error, but will keep the value of *buf pointing to already
freed memory.

The caller of tor_getline() would free the pointer again, therefore
leading to a double free.

This code can only be triggered in dirserv_read_measured_bandwidths
with a huge measured bandwith list file on a system that actually
allows to reach 2 GB of space through realloc.

It is not possible to trigger this on Linux with glibc or other major
*BSD systems even on unit tests, because these systems cannot reach
so much memory due to memory fragmentation.

This patch is effectively based on the penetration test report of
cure53 for curl available at https://cure53.de/pentest-report_curl.pdf
and explained under section "CRL-01-007 Double-free in aprintf() via
unsafe size_t multiplication (Medium)".
2019-04-10 12:46:27 +03:00
teor
5722c6d12d
scripts: In git-pull-all.sh, also fetch the latest tor-github pull requests
Implements ticket 30114.
2019-04-10 19:26:47 +10:00
teor
60c46c6cd0
practracker: accept 4 extra lines due to 30041 2019-04-10 18:29:11 +10:00
teor
a1d9f44971
Merge branch 'maint-0.4.0' 2019-04-10 18:27:11 +10:00
teor
454bdb22ee
Merge remote-tracking branch 'tor-github/pr/920' into maint-0.4.0 2019-04-10 18:26:49 +10:00
teor
ce9b101574
bwauth: update measured bandwidth file comments
We forgot to update function header comments and code comments when we
made changes in 0.3.5.1-alpha and later.

Closes 30112.
2019-04-10 15:57:54 +10:00
Nick Mathewson
c28cdcc9bf Merge branch 'maint-0.4.0' 2019-04-09 13:51:44 -04:00
Nick Mathewson
ffdca3dd14 Merge branch 'bug29922_035' into maint-0.4.0 2019-04-09 13:49:58 -04:00
Nick Mathewson
9f3f99938e Actually I believe this should be an EINVAL. 2019-04-09 13:49:10 -04:00
Nick Mathewson
c24928dd8f Changes file for bug30041 2019-04-09 12:05:33 -04:00
Tobias Stoeckmann
a628e36024 Check return value of buf_move_to_buf for error.
If the concatenation of connection buffer and the buffer of linked
connection exceeds INT_MAX bytes, then buf_move_to_buf returns -1 as an
error value.

This value is currently casted to size_t (variable n_read) and will
erroneously lead to an increasement of variable "max_to_read".

This in turn can be used to call connection_buf_read_from_socket to
store more data inside the buffer than expected and clogging the
connection buffer.

If the linked connection buffer was able to overflow INT_MAX, the call
of buf_move_to_buf would have previously internally triggered an integer
overflow, corrupting the state of the connection buffer.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
2019-04-09 12:05:22 -04:00
Tobias Stoeckmann
5a6ab3e7db Protect buffers against INT_MAX datalen overflows.
Many buffer functions have a hard limit of INT_MAX for datalen, but
this limitation is not enforced in all functions:

- buf_move_all may exceed that limit with too many chunks
- buf_move_to_buf exceeds that limit with invalid buf_flushlen argument
- buf_new_with_data may exceed that limit (unit tests only)

This patch adds some annotations in some buf_pos_t functions to
guarantee that no out of boundary access could occur even if another
function lacks safe guards against datalen overflows.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
2019-04-09 12:05:14 -04:00
George Kadianakis
16041d7918 Merge branch 'maint-0.4.0' 2019-04-09 12:25:18 +03:00
George Kadianakis
c7cf49dc3c Merge branch 'tor-github/pr/915' into maint-0.4.0 2019-04-09 12:24:52 +03:00
teor
3d45079c27
Merge branch 'maint-0.4.0' 2019-04-09 11:36:59 +10:00
teor
e4692fad96
Merge remote-tracking branch 'tor-github/pr/866' 2019-04-09 11:36:38 +10:00
teor
2dab7a1078
Merge remote-tracking branch 'tor-github/pr/862' 2019-04-09 11:36:12 +10:00
teor
92e8bdf296
Merge remote-tracking branch 'tor-github/pr/892' into maint-0.4.0 2019-04-09 11:35:41 +10:00
rl1987
61e6b217c5
manpage: Clarify that Tor does stream isolation between *Port listeners by default
cherry-pick of tor-github/pr/841 to maint-0.4.0.
2019-04-09 11:34:51 +10:00
Nick Mathewson
a63bd87760 Detect and suppress an additional gmtime() warning in test_util.c
Fixes bug 29922; bugfix on 0.2.9.3-alpha when we tried to capture
all these warnings.  No need to backport any farther than 0.3.5,
though -- these warnings don't cause test failures before then.

This one was tricky to find because apparently it only happened on
_some_ windows builds.
2019-04-08 17:02:14 -04:00
rl1987
0e0a0b9802 Fix SC2006 in minimize.sh 2019-04-08 11:16:45 +03:00
teor
7741b21d0e
practracker: accept 6 extra lines in tortls_nss.c:tor_tls_context_new()
These lines were added to fix bug 29241.
2019-04-06 12:26:30 +10:00
teor
4cffc7fe9c
Merge branch 'maint-0.4.0' 2019-04-06 12:23:25 +10:00
teor
b100c9e980
Merge remote-tracking branch 'tor-github/pr/911' into maint-0.4.0 2019-04-06 12:15:41 +10:00
teor
4dd96f7444
changes: Ticket 29241 is actually a bug on NSS in 0.3.5.1-alpha 2019-04-06 11:07:20 +10:00
Nick Mathewson
5cb94cbf9d
NSS: disable TLS1.2 SHA-384 ciphersuites.
In current NSS versions, these ciphersuites don't work with
SSL_ExportKeyingMaterial(), which was causing relays to fail when
they tried to negotiate the v3 link protocol authentication.

Fixes bug 29241; bugfix on 0.4.0.1-alpha.
2019-04-06 11:06:34 +10:00
Nick Mathewson
680fd3f8fb
NSS: Log an error message when SSL_ExportKeyingMaterial() fails
Diagnostic for 29241.
2019-04-06 11:06:22 +10:00
teor
f213a35b2f
Merge branch 'maint-0.4.0' 2019-04-06 09:33:38 +10:00
teor
8b3b605a15
Merge branch 'maint-0.3.5' into maint-0.4.0 2019-04-06 09:33:28 +10:00
teor
3b9e3cca94
Merge branch 'maint-0.3.4' into maint-0.3.5 2019-04-06 09:33:20 +10:00
teor
48e990359b
Merge branch 'maint-0.2.9' into maint-0.3.4 2019-04-06 09:33:11 +10:00
teor
316aed502e
Merge remote-tracking branch 'tor-github/pr/898' into maint-0.3.5 2019-04-06 09:32:53 +10:00
teor
ea5e371822
Merge remote-tracking branch 'tor-github/pr/903' into maint-0.3.5 2019-04-06 09:31:52 +10:00
teor
44ea341117
Merge remote-tracking branch 'tor-github/pr/879' into maint-0.3.5 2019-04-06 09:30:52 +10:00
teor
102178e6d4
Merge remote-tracking branch 'tor-github/pr/878' into maint-0.3.4 2019-04-06 09:30:04 +10:00
teor
a0db5ade3e
Merge remote-tracking branch 'tor-github/pr/902' into maint-0.2.9 2019-04-06 09:28:58 +10:00
teor
e1955a2c54
Merge remote-tracking branch 'tor-github/pr/877' into maint-0.2.9 2019-04-06 09:28:13 +10:00
rl1987
e8e6931638 Add changes file 2019-04-05 19:03:41 +03:00
rl1987
705c1c28c7 Call pre-commit hook from pre-push script 2019-04-05 18:59:48 +03:00
Nick Mathewson
f021ca2d52 practracker: allow config.c to be a touch larger. 2019-04-05 09:59:45 -04:00
George Kadianakis
df4e2c42a8 Merge branch 'tor-github/pr/907' 2019-04-05 16:45:55 +03:00
George Kadianakis
071a000d67 Merge branch 'tor-github/pr/906' into maint-0.4.0 2019-04-05 16:44:59 +03:00
George Kadianakis
5584b6392d Merge branch 'maint-0.4.0' 2019-04-05 14:57:06 +03:00
George Kadianakis
2cc3c98bc4 Merge branch 'tor-github/pr/901' into maint-0.4.0 2019-04-05 14:56:52 +03:00
George Kadianakis
76f1763976 Merge branch 'maint-0.4.0' 2019-04-05 14:55:22 +03:00