[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #17776 [Tor]: Buffer over-reads in directory and rendcache tests

#17776: Buffer over-reads in directory and rendcache tests
-------------------------+----------------------------------
 Reporter:  cypherpunks  |          Owner:
     Type:  defect       |         Status:  needs_revision
 Priority:  Medium       |      Milestone:
Component:  Tor          |        Version:  Tor: unspecified
 Severity:  Normal       |     Resolution:
 Keywords:               |  Actual Points:
Parent ID:               |         Points:
  Sponsor:               |
-------------------------+----------------------------------
Changes (by teor):

 * status:  needs_review => needs_revision


Comment:

 Replying to [comment:1 cypherpunks]:
 > The attached patches fixes the issues mentioned in the ticket
 description. I hope the commit messages speak for themselves. Rewriting
 them into the ticket seemed redundant.

 Code Review: Patches 1 & 2

 I agree that these buffer overruns need to be fixed.

 But what I'd like to do is change the functions that overrun the buffers
 so they don't overrun buffers if a short string is passed to them. That
 way, we fix the problem at the source.

 I want to check that the fingerprint strings are:
 * not NULL, and
 * don't contain a NULL character in the first DIGEST_LEN bytes?
 before the functions read the strings?

 You can use code like:
 {{{
 tor_assert(fingerprint);
 tor_assert(memchr(fingerprint, 0, DIGEST_LEN) == NULL);
 }}}

 That would also require updating all the test data so it's really
 DIGEST_LEN characters long (and increasing the buffer lengths by 1 to
 accommodate the terminating nul byte).

 > Patch 0003 is not related to this ticket other than that i found it
 while working on this ticket. I can open a separate ticket for it if that
 is preferred.

 Separate commits is great (and sufficient).

 Code Review: Patch 3

 Patch 0003 removes an unnecessary cast, let's merge Patch 3 only.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17776#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs