[tor-bugs] #19011 [Core Tor/Tor]: Use of maxunmeasuredbw and bwweightscale is broken in consensus

["Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>]

#19011: Use of maxunmeasuredbw and bwweightscale is broken in consensus
------------------------------+--------------------------
     Reporter:  nickm         |      Owner:
         Type:  defect        |     Status:  new
     Priority:  Medium        |  Milestone:
    Component:  Core Tor/Tor  |    Version:
     Severity:  Normal        |   Keywords:  029-proposed
Actual Points:                |  Parent ID:
       Points:  0.5           |   Reviewer:
      Sponsor:                |
------------------------------+--------------------------
 While refactoring, I noticed this code in dirvote.c:
 {{{
     if (params) {
       if (strcmpstart(params, "bwweightscale=") == 0)
         bw_weight_param = params;
       else
         bw_weight_param = strstr(params, " bwweightscale=");
     }

     if (bw_weight_param) {
       int ok=0;
       char *eq = strchr(bw_weight_param, '=');
       if (eq) {
         weight_scale = tor_parse_long(eq+1, 10, 1, INT32_MAX, &ok,
                                          NULL);
         if (!ok) {
           log_warn(LD_DIR, "Bad element '%s' in bw weight param",
               escaped(bw_weight_param));
           weight_scale = BW_WEIGHT_SCALE;
         }
       } else {
         log_warn(LD_DIR, "Bad element '%s' in bw weight param",
             escaped(bw_weight_param));
         weight_scale = BW_WEIGHT_SCALE;
       }
     }
 }}}

 Looking at the use of tor_parse_ulong(). Since "next" is NULL, any
 unconverted characters should make it give an error, making us use the
 default value.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19011>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs