#2326: carefully crafted cache file sizes can trigger assert
-----------------------+----------------------------------------------------
Reporter: arma | Owner:
Type: defect | Status: new
Priority: major | Milestone: Tor: 0.2.1.x-final
Component: Tor Relay | Version:
Keywords: | Parent:
-----------------------+----------------------------------------------------
In read_file_to_str() we do
{{{
if ((uint64_t)(statbuf.st_size)+1 > SIZE_T_CEILING)
return NULL;
string = tor_malloc((size_t)(statbuf.st_size+1));
}}}
So a remote attacker who can give you a combination of cached blobs such
that one of your files becomes exactly SIZE_T_CEILING bytes (just 2 gigs
on a 32 bit platform) could cause your Tor to consistently assert on
start.
The fix is to check >= instead of >.
Reported by doors.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2326>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs