Nick Mathewson 4812441d34 Never read off the end of a buffer in base32_encode() ... When we "fixed" #18280 in 4e4a7d2b0c in 0291 it appears that we introduced a bug: The base32_encode function can read off the end of the input buffer, if the input buffer size modulo 5 is not equal to 0 or 3. This is not completely horrible, for two reasons: * The extra bits that are read are never actually used: so this is only a crash when asan is enabled, in the worst case. Not a data leak. * The input sizes passed to base32_encode are only ever multiples of 5. They are all either DIGEST_LEN (20), REND_SERVICE_ID_LEN (10), sizeof(rand_bytes) in addressmap.c (10), or an input in crypto.c that is forced to a multiple of 5. So this bug can't actually trigger in today's Tor. Closes bug 21894; bugfix on 0.2.9.1-alpha.		2017-04-07 10:47:16 -04:00
..
.dummy	Add a .dummy file in the changes directory to stop git from removing it	2015-05-11 11:41:48 -04:00
19974	Increase tolerances in util/monotonic_time tests	2016-12-07 11:08:54 -05:00
20460	Make new changes files pass lintchanges	2016-11-07 16:19:05 -05:00
20492	Test for .git as readable instead of a dir to support worktrees	2016-12-05 08:21:17 -05:00
21359	Rework 21359 changes file slightly.	2017-02-01 10:39:48 -05:00
bug19869	Avoid tor_fragile_assert() failure with DNSPort on RESOLVED_TYPE_ERROR	2016-10-26 14:16:40 -04:00
bug19926_029_info	Downgrade a harmless bug warning to info.	2016-12-09 08:43:09 -05:00
bug19960	Netbsd doesn't have ipfw, only the regular pf transport stuff.	2016-12-07 15:22:44 -05:00
bug19968	Actually clamp the number of detected CPUs to 16.	2016-10-31 14:19:39 -04:00
bug19969	Fix warnings from lintChanges.py	2016-11-06 16:39:46 -05:00
bug20085	In torrc.sample.in, note that bandwidth must be >=75 KB.	2016-11-08 19:23:49 -05:00
bug20235	Try to work around breakage in the OSX 10.12 SDK.	2016-11-22 19:24:13 -05:00
bug20306_029	policy_is_reject_star():	2016-10-31 15:05:56 -04:00
bug20307	clean up grammar on bug20307 changes file	2017-01-22 19:03:12 -05:00
bug20401	Actually free the worker_state_t object when we do an update with it	2016-10-31 15:20:25 -04:00
bug20423	don't attempt a resolve when the cached answer will do	2016-11-16 16:22:11 -05:00
bug20472	Fix warnings from lintChanges.py	2016-11-06 16:39:46 -05:00
bug20484	Create single-onion-service directory before poisoning it, if needed	2016-10-31 14:54:20 -04:00
bug20487	Add a sentence to the manpage about nonanonymous=>Socksport 0.	2016-10-31 15:13:27 -04:00
bug20529	Check every hidden service directory's permissions when configuring	2016-11-02 14:32:04 +11:00
bug20533	When downloading certificates, check for related failures	2016-11-08 00:01:20 +11:00
bug20534	Adjust download schedules per teor's #20534 recommendataions	2016-11-07 11:01:20 -05:00
bug20536	Do not apply 'max_failures' to random-exponential schedules.	2016-11-06 20:08:11 -05:00
bug20551	Fix warnings from lintChanges.py	2016-11-06 16:39:46 -05:00
bug20553	Work around a behavior change in openssl's BUF_MEM code	2016-11-03 10:51:10 -04:00
bug20560	Use va_copy() in pure-windows version of tor_asprintf().	2016-11-08 18:44:06 -05:00
bug20587	Make new changes files pass lintchanges	2016-11-07 16:19:05 -05:00
bug20588	Always Use EVP_aes_*_ctr() with openssl 1.1	2016-12-05 07:54:22 -05:00
bug20591	Ensure relays don't make multiple connections during bootstrap	2016-11-07 23:05:55 +11:00
bug20593	Count HTTP 503 as a download failure.	2016-11-07 11:01:21 -05:00
bug20597	When using exponential backoff in test networks, use a lower exponent	2016-11-08 16:42:26 +11:00
bug20613	Stop logging single onion and Tor2web long-term one-hop circuits	2016-11-09 11:23:51 +11:00
bug20634	Changes file for bug 20634	2016-11-16 13:14:03 +11:00
bug20638	Stop ignoring hidden service key anonymity when first starting tor	2016-12-01 09:44:53 -05:00
bug20710_025	Forgot to add changes file for 20710.	2016-12-07 10:51:39 -05:00
bug20715	router: Fix memory leak in signed_descriptor_move()	2016-12-09 08:30:46 -05:00
bug20716	Fix memory leak in bug 20716	2016-12-01 10:14:42 -05:00
bug20810	protover: Fix old tor hardcoded version check	2016-12-02 12:09:08 -05:00
bug20864	Fix changes file for 20864: 20638 _did_ get into 0.2.9	2016-12-05 08:12:10 -05:00
bug20875	Fix a BUG() warning from next_random_exponential_delay().	2016-12-07 11:13:11 -05:00
bug20935	Spell MAC_OS_X_VERSION_10_12 correctly.	2016-12-11 22:17:14 -05:00
bug21018	Fix parsing bug with unecognized token at EOS	2016-12-18 20:17:24 -05:00
bug21035	changes file for 21035.	2016-12-23 08:08:14 -05:00
bug21051	Use event_base_new(), not event_init(), to detect libevent 2.	2016-12-23 08:18:31 -05:00
bug21108_029	Do not clear is_bad_exit on sybil.	2017-01-31 14:12:14 -05:00
bug21278_extras	changes file for removing compare-by-subtraction pattern	2017-02-14 16:32:59 -05:00
bug21278_prevention	When examining descriptors as a dirserver, reject ones with bad versions	2017-02-15 07:46:34 -05:00
bug21280	changes file for 21280	2017-02-07 09:27:17 -05:00
bug21357	Changes file for 21357: Stop rejecting all IPv6 traffic on some Exits	2017-02-01 09:39:06 -05:00
bug21450	Limit version numbers to 0...INT32_MAX.	2017-02-15 07:57:34 -05:00
bug21894_029	Never read off the end of a buffer in base32_encode()	2017-04-07 10:47:16 -04:00
geoip-april2017	Update geoip and geoip6 to the April 4 2017 database.	2017-04-06 10:52:39 +02:00
geoip-december2016	Update geoip and geoip6 to the December 7 2016 database.	2016-12-09 10:23:36 +01:00
geoip-february2017	Update geoip and geoip6 to the February 8 2017 database.	2017-02-12 15:56:31 +01:00
geoip-january2017	fix a lintchanges warning	2017-01-22 18:48:22 -05:00
geoip-march2017	Update geoip and geoip6 to the March 7 2017 database.	2017-03-08 09:41:35 +01:00
geoip-november2016	Make new changes files pass lintchanges	2016-11-07 16:19:05 -05:00
more_module_docs	changes file for module docs	2016-10-18 19:35:10 -04:00
ticket20170-v3	Update the fallback directory mirror list in December 2016	2016-12-19 15:44:20 +11:00
trove-2017-001	TROVE-2017-001 : move -ftrapv back into --expensive-hardening.	2017-01-23 08:47:10 -05:00
trove-2017-001.2	Avoid integer underflow in tor_version_compare.	2017-02-14 16:10:27 -05:00