sarah
/
tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
tor/src/or
History
Nick Mathewson 8d2978b13c Fix an errant memset() into the middle of a struct in cell_pack(). 
This mistake causes two possible bugs. I believe they are both
harmless IRL.

BUG 1: memory stomping

When we call the memset, we are overwriting two 0 bytes past the end
of packed_cell_t.body. But I think that's harmless in practice,
because the definition of packed_cell_t is:

// ...
typedef struct packed_cell_t {
  TOR_SIMPLEQ_ENTRY(packed_cell_t) next;
  char body[CELL_MAX_NETWORK_SIZE];
  uint32_t inserted_time;
} packed_cell_t;

So we will overwrite either two bytes of inserted_time, or two bytes
of padding, depending on how the platform handles alignment.

If we're overwriting padding, that's safe.

If we are overwriting the inserted_time field, that's also safe: In
every case where we call cell_pack() from connection_or.c, we ignore
the inserted_time field. When we call cell_pack() from relay.c, we
don't set or use inserted_time until right after we have called
cell_pack(). SO I believe we're safe in that case too.

BUG 2: memory exposure

The original reason for this memset was to avoid the possibility of
accidentally leaking uninitialized ram to the network. Now
remember, if wide_circ_ids is false on a connection, we shouldn't
actually be sending more than 512 bytes of packed_cell_t.body, so
these two bytes can only leak to the network if there is another bug
somewhere else in the code that sends more data than is correct.

Fortunately, in relay.c, where we allocate packed_cell_t in
packed_cell_new() , we allocate it with tor_malloc_zero(), which
clears the RAM, right before we call cell_pack. So those
packed_cell_t.body bytes can't leak any information.

That leaves the two calls to cell_pack() in connection_or.c, which
use stack-alocated packed_cell_t instances.

In or_handshake_state_record_cell(), we pass the cell's contents to
crypto_digest_add_bytes(). When we do so, we get the number of
bytes to pass using the same setting of wide_circ_ids as we passed
to cell_pack(). So I believe that's safe.

In connection_or_write_cell_to_buf(), we also use the same setting
of wide_circ_ids in both calls. So I believe that's safe too.

I introduced this bug with 1c0e87f6d8
back in 0.2.4.11-alpha; it is bug 22737 and CID 1401591
 		2017-06-27 10:47:20 -04:00
..
Makefile.nmake Merge bug5595-v2-squashed into maint-0.2.4 2013-05-10 19:39:48 -07:00
addressmap.c Controller: Add CACHED keyword to ADDRMAP events (#8596 part 2/2) 2013-04-03 18:50:51 +02:00
addressmap.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
buffers.c Add a one-word sentinel value of 0x0 at the end of each buf_t chunk 2016-12-20 18:18:53 -05:00
buffers.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
channel.c Fix a bug in our bug 9776 fix. 2013-10-02 22:20:18 -04:00
channel.h Supply better and less frequent warnings on circID exhaustion 2014-04-18 12:31:06 -04:00
channeltls.c Make sure orconn->chan gets nulled out when channels exit from channel_free_all() too 2014-02-08 14:05:51 -08:00
channeltls.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
circuitbuild.c Implement proposal 221: Stop sending CREATE_FAST 2014-07-25 11:59:00 -04:00
circuitbuild.h use !cbt_disabled in place of LearnCBT to avoid needless circs 2013-09-04 15:54:05 -04:00
circuitlist.c Discard circuit paths on which nobody supports ntor 2014-02-07 10:45:34 -05:00
circuitlist.h Discard circuit paths on which nobody supports ntor 2014-02-07 10:45:34 -05:00
circuitmux.c Fix 8447: use %u to format circid_t. 2013-03-10 19:52:06 -04:00
circuitmux.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
circuitmux_ewma.c Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
circuitmux_ewma.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
circuitstats.c Clarify liveness log message and lower it to notice. 2013-03-27 16:22:43 -07:00
circuitstats.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
circuituse.c circuit_build_failed: distinguish "first hop chan failed", "CREATE failed" 2014-07-25 11:59:00 -04:00
circuituse.h Stop frobbing timestamp_dirty as our sole means to mark circuits unusable 2013-02-19 18:29:17 -05:00
command.c Warn and drop the circuit if we receive an inbound 'relay early' cell 2014-07-28 02:44:05 -04:00
command.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
config.c Backport the tonga->bifroest move to 0.2.4. 2017-02-07 09:15:21 -05:00
config.h get rid of the new caching notion in resolve_my_address() 2013-02-12 04:25:42 -05:00
config_codedigest.c Resolve about 24 DOCDOCs 2012-06-05 00:17:54 -04:00
confparse.c Merge branch 'bug8240_v2_squashed' into maint-0.2.4 2013-03-19 16:15:27 -04:00
confparse.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
connection.c NULL out conns on tlschans when freeing in case channel_run_cleanup() is late; fixes bug 9602 2014-02-06 14:47:34 -08:00
connection.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
connection_edge.c Fix a compilation warning introduced by clang 3.6 2015-12-08 09:37:05 -05:00
connection_edge.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
connection_or.c Fix an errant memset() into the middle of a struct in cell_pack(). 2017-06-27 10:47:20 -04:00
connection_or.h Merge remote-tracking branch 'public/wide_circ_ids' 2013-02-15 16:23:43 -05:00
control.c Confusing log message when circuit can't be extended 2014-07-27 15:01:15 -04:00
control.h Merge remote-tracking branch 'public/bug8716_023' into maint-0.2.4 2013-04-18 21:33:53 -04:00
cpuworker.c collect and log statistics about onionskins received/processed 2013-09-05 01:44:52 -04:00
cpuworker.h Merge branch 'time_based_onionqueue_v2' of ssh://git-rw.torproject.org/nickm/tor 2013-01-24 08:10:12 -08:00
directory.c Generate bootstrapping status messages for microdescs too 2013-10-08 11:32:02 -04:00
directory.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
dirserv.c Make all consumers of microdesc_t.body tolerate NULL 2013-06-12 12:12:11 -04:00
dirserv.h Merge branch 'less_charbuf_rebased' into maint-0.2.4 2013-04-18 11:13:36 -04:00
dirvote.c Merge remote-tracking branch 'public/bug10409_023' into maint-0.2.4 2013-12-17 13:15:45 -05:00
dirvote.h Rename all fields which measure bw in kb to end with _kb 2013-04-14 21:45:05 -04:00
dns.c Avoid attempts to double-remove edge connections from the DNS resolver. 2015-01-08 11:00:21 -05:00
dns.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
dnsserv.c When launching a resolve request on behalf of an AF_UNIX control, omit the address field of the new entry connection. Fixes bug 8639. 2013-05-31 15:35:51 -07:00
dnsserv.h Fix some wide lines 2013-03-18 15:39:11 -04:00
entrynodes.c add a NumDirectoryGuards consensus param too 2014-07-24 16:19:47 -04:00
entrynodes.h Merge remote-tracking branch 'public/feature4994-rebased' 2013-02-15 15:58:54 -05:00
eventdns_tor.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
fp_pair.c Implement fp_pair_map_t 2013-05-09 10:54:55 -07:00
fp_pair.h Implement fp_pair_map_t 2013-05-09 10:54:55 -07:00
geoip.c Fix C89 warning (since Tor 0.2.4-5 still care about that.) 2017-06-05 14:38:38 -04:00
geoip.h Remove dirreq-v2-* lines from extra-info descriptors. 2013-01-17 10:46:34 +01:00
hibernate.c Remove a bunch of unused macro definitions 2013-02-23 23:05:25 -05:00
hibernate.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
include.am Merge bug5595-v2-squashed into maint-0.2.4 2013-05-10 19:39:48 -07:00
main.c Disable a log_backtrace (which 0.2.4 does not have) in 16248 fix 2017-02-07 09:49:23 -05:00
main.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
microdesc.c Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 2014-05-01 11:44:25 -04:00
microdesc.h Log fname:lineno in log messages for #7164 2013-03-13 10:42:58 -04:00
networkstatus.c Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 2014-04-14 18:00:38 -04:00
networkstatus.h Remove some totally unused functions 2013-02-23 23:31:31 -05:00
nodelist.c Make PathsNeededToBuildCircuits option work. 2013-03-28 09:32:19 -04:00
nodelist.h On END_REASON_EXITPOLICY, mark circuit as unusable for that address. 2013-03-11 23:37:47 -04:00
ntmain.c Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
ntmain.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
onion.c Revert e443beff and solve it a different way 2013-09-05 01:41:07 -04:00
onion.h refactor and give it unit tests 2013-09-04 23:21:45 -04:00
onion_fast.c Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
onion_fast.h Wrap more macro definitions in (parentheses) 2013-02-09 00:16:04 -05:00
onion_ntor.c Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
onion_ntor.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
onion_tap.c Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
onion_tap.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
or.h Block multiple introductions on the same intro circuit. 2015-04-03 09:35:47 -04:00
policies.c On END_REASON_EXITPOLICY, mark circuit as unusable for that address. 2013-03-11 23:37:47 -04:00
policies.h Increase POLICY_BUF_LEN to 72 to accomodate IPv6 exit policy items. 2013-08-26 11:30:09 -04:00
reasons.c Fix windows compilation of e0c8031516 2014-02-12 09:16:22 -05:00
reasons.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
relay.c TROVE-2017-005: Fix assertion failure in connection_edge_process_relay_cell 2017-06-08 09:21:10 -04:00
relay.h Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 2013-06-18 10:23:03 -04:00
rendclient.c clients now send correct address for rendezvous point 2014-09-16 11:05:36 -04:00
rendclient.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
rendcommon.c Make log message warn about detected attempts to exploit 21018. 2016-12-18 20:17:28 -05:00
rendcommon.h Remove some totally unused functions 2013-02-23 23:31:31 -05:00
rendmid.c ... and if we do get multiple INTRODUCE1s on a circuit, kill the circuit 2015-04-03 09:36:05 -04:00
rendmid.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
rendservice.c Fix out-of-bounds read in INTRODUCE2 client auth 2017-02-07 08:31:37 -05:00
rendservice.h Fix an uninitialized-read when parsing v3 introduction requests. 2013-08-10 17:49:51 -04:00
rephist.c Deliver circuit handshake counts as part of the heartbeat 2014-02-06 13:03:01 -05:00
rephist.h collect and log statistics about onionskins received/processed 2013-09-05 01:44:52 -04:00
replaycache.c Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
replaycache.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
router.c Fix two more DirServer mentions in log 2013-11-10 12:23:56 -05:00
router.h Merge remote-tracking branch 'public/bug6026' into maint-0.2.4 2013-04-24 22:15:47 -04:00
routerlist.c Ensure node is a guard candidate when picking a directory guard 2015-12-08 09:49:01 -05:00
routerlist.h Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 2014-04-14 18:00:38 -04:00
routerparse.c Avoid integer underflow in tor_version_compare. 2017-02-14 16:10:27 -05:00
routerparse.h Merge remote-tracking branch 'public/bug10409_023' into maint-0.2.4 2013-12-17 13:15:45 -05:00
routerset.c Fix typos in a few log messages 2013-03-10 22:59:19 -04:00
routerset.h When excluding nodes by country, exclude {??} and {A1} too 2013-01-17 18:07:36 -05:00
statefile.c Add EntryGuardPathUseBias to state file keyword list. 2013-02-01 17:01:26 -05:00
statefile.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
status.c Add a missing include 2014-02-06 13:25:36 -05:00
status.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00
tor_main.c Fix a comment in tor_main.c 2013-02-25 03:24:53 -05:00
transports.c Fix invalid-read when a managed proxy configuration fails. 2013-07-31 13:56:07 -04:00
transports.h Update the copyright date to 201. 2013-01-16 01:54:56 -05:00