Re: [tor-bugs] #21369 [Core Tor/Tor]: Tor crashes with tor_assertion_failed_() [Assertion buf->datalen < INT_MAX failed in write_to_buf at ../src/or/buffers.c:832]

["Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>]

#21369: Tor crashes with tor_assertion_failed_() [Assertion buf->datalen < INT_MAX
failed in write_to_buf at ../src/or/buffers.c:832]
--------------------------+------------------------------------
 Reporter:  svengo        |          Owner:  nickm
     Type:  defect        |         Status:  needs_review
 Priority:  Very High     |      Milestone:  Tor: 0.3.0.x-final
Component:  Core Tor/Tor  |        Version:  Tor: 0.2.9.9
 Severity:  Critical      |     Resolution:
 Keywords:  029-backport  |  Actual Points:
Parent ID:                |         Points:
 Reviewer:                |        Sponsor:
--------------------------+------------------------------------

Comment (by nickm):

 Teor said:
 > I think connection_dirserv_add_dir_bytes_to_outbuf() is the most likely
 candidate here. remaining/bytes is a signed integer that could easily go
 negative if the offset gets out of sync, and then the
 int64_t/ssize_t/size_t cast would make it a large positive integer (it's
 on 64-bit, note the x86_64-linux-gnu backtrace line).

 Hm.  If this is the case, then I bet my patch would detect that case and
 stop it.  What if I add an extra check in
 connection_dirserve_add_dir_bytes_to_outbuf() ?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21369#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs