[tor-bugs] #31001 [Core Tor/Tor]: Undefined behavior in tor_vasprintf()

["Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>]

#31001: Undefined behavior in tor_vasprintf()
------------------------------+-------------------------------------------
     Reporter:  asn           |      Owner:  (none)
         Type:  defect        |     Status:  new
     Priority:  Medium        |  Milestone:  Tor: 0.4.1.x-final
    Component:  Core Tor/Tor  |    Version:
     Severity:  Normal        |   Keywords:  041-must hackerone bug-bounty
Actual Points:                |  Parent ID:
       Points:                |   Reviewer:
      Sponsor:                |
------------------------------+-------------------------------------------
 {{{
 Overflowing a signed integer in C is an undefined behaviour.
 It is possible to trigger this undefined behaviour in tor_asprintf on
 Windows or systems lacking vasprintf.

 On these systems, eiter _vscprintf or vsnprintf is called to retrieve
 the required amount of bytes to hold the string. These functions can
 return INT_MAX. The easiest way to recreate this is the use of a
 specially crafted configuration file, e.g. containing the line:

 FirewallPorts AAAAA<in total 2147483610 As>

 This line triggers the needed tor_asprintf call which eventually
 leads to an INT_MAX return value from _vscprintf or vsnprintf.

 The needed byte for \0 is added to the result, triggering the
 overflow and therefore the undefined behaviour.

 Casting the value to size_t before addition fixes the behaviour.

 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31001>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs