Re: [tor-bugs] #26284 [Core Tor/Tor]: Out-of-bounds smartlist access in protover_compute_vote()

[Tor Bug Tracker & Wiki]

#26284: Out-of-bounds smartlist access in protover_compute_vote()
--+
 Reporter:  rl1987|  Owner:  rl1987
 Type:  defect| Status:  closed
 Priority:  Medium|  Milestone:  Tor: 0.2.9.x-final
Component:  Core Tor/Tor  |Version:  Tor: unspecified
 Severity:  Normal| Resolution:  fixed
 Keywords:  fast-fix  |  Actual Points:
Parent ID:  #26196| Points:
 Reviewer:  asn   |Sponsor:
--+
Changes (by nickm):

 * status:  merge_ready => closed
 * resolution:   => fixed
 * milestone:  Tor: 0.3.4.x-final => Tor: 0.2.9.x-final


Comment:

 Cherry-picked to 0.2.9, and merged forward!

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #26284 [Core Tor/Tor]: Out-of-bounds smartlist access in protover_compute_vote()

[Tor Bug Tracker & Wiki]

#26284: Out-of-bounds smartlist access in protover_compute_vote()
--+
 Reporter:  rl1987|  Owner:  rl1987
 Type:  defect| Status:  merge_ready
 Priority:  Medium|  Milestone:  Tor: 0.3.4.x-final
Component:  Core Tor/Tor  |Version:  Tor: unspecified
 Severity:  Normal| Resolution:
 Keywords:  fast-fix  |  Actual Points:
Parent ID:  #26196| Points:
 Reviewer:  asn   |Sponsor:
--+

Comment (by asn):

 LGTM!

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #26284 [Core Tor/Tor]: Out-of-bounds smartlist access in protover_compute_vote()

[Tor Bug Tracker & Wiki]

#26284: Out-of-bounds smartlist access in protover_compute_vote()
--+
 Reporter:  rl1987|  Owner:  rl1987
 Type:  defect| Status:  merge_ready
 Priority:  Medium|  Milestone:  Tor: 0.3.4.x-final
Component:  Core Tor/Tor  |Version:  Tor: unspecified
 Severity:  Normal| Resolution:
 Keywords:  fast-fix  |  Actual Points:
Parent ID:  #26196| Points:
 Reviewer:  asn   |Sponsor:
--+
Changes (by rl1987):

 * status:  needs_revision => merge_ready


Comment:

 https://github.com/torproject/tor/pull/138

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #26284 [Core Tor/Tor]: Out-of-bounds smartlist access in protover_compute_vote()

[Tor Bug Tracker & Wiki]

#26284: Out-of-bounds smartlist access in protover_compute_vote()
--+
 Reporter:  rl1987|  Owner:  rl1987
 Type:  defect| Status:  needs_revision
 Priority:  Medium|  Milestone:  Tor: 0.3.4.x-final
Component:  Core Tor/Tor  |Version:  Tor: unspecified
 Severity:  Normal| Resolution:
 Keywords:  fast-fix  |  Actual Points:
Parent ID:  #26196| Points:
 Reviewer:  asn   |Sponsor:
--+

Comment (by asn):

 Fixups LGTM.

 Please squash the branch so that it's just one commit.

 Also please consider adding some curly braces in this if clause:
 {{{
 +  if (smartlist_len(list_of_proto_strings) == 0)
 +return tor_strdup("");
 }}}
 IMO, we should be adding curly braces even in trivial if statements to
 avoid potential Apple `goto fail` issues ;)

 After you do so, feel free to turn it into merge_ready.

 Thanks! :)

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #26284 [Core Tor/Tor]: Out-of-bounds smartlist access in protover_compute_vote()

[Tor Bug Tracker & Wiki]

#26284: Out-of-bounds smartlist access in protover_compute_vote()
--+
 Reporter:  rl1987|  Owner:  rl1987
 Type:  defect| Status:  needs_revision
 Priority:  Medium|  Milestone:  Tor: 0.3.4.x-final
Component:  Core Tor/Tor  |Version:  Tor: unspecified
 Severity:  Normal| Resolution:
 Keywords:  fast-fix  |  Actual Points:
Parent ID:  #26196| Points:
 Reviewer:  asn   |Sponsor:
--+

Comment (by rl1987):

 This bug emerged when I was working on #26196. The simplest way to
 reproduce is to add `#define DEBUG_SMARTLIST` to orconfig.h, recompile and
 run `make test`. There are several unit tests that crash in
 `protover_compute_vote()`.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #26284 [Core Tor/Tor]: Out-of-bounds smartlist access in protover_compute_vote()

[Tor Bug Tracker & Wiki]

#26284: Out-of-bounds smartlist access in protover_compute_vote()
--+
 Reporter:  rl1987|  Owner:  rl1987
 Type:  defect| Status:  needs_revision
 Priority:  Medium|  Milestone:  Tor: 0.3.4.x-final
Component:  Core Tor/Tor  |Version:  Tor: unspecified
 Severity:  Normal| Resolution:
 Keywords:  fast-fix  |  Actual Points:
Parent ID:  #26196| Points:
 Reviewer:  asn   |Sponsor:
--+
Changes (by asn):

 * status:  needs_review => needs_revision


Comment:

 Cool find rl1987! How did you repro this?

 Do you think this needs to be backported? The way I understand it this can
 only trigger if all authorities don't participate in the protover
 protocol, which seems pretty unlikely.

 Also I made some notes in the PR! Let me know how you like them!

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #26284 [Core Tor/Tor]: Out-of-bounds smartlist access in protover_compute_vote()

[Tor Bug Tracker & Wiki]

#26284: Out-of-bounds smartlist access in protover_compute_vote()
--+
 Reporter:  rl1987|  Owner:  rl1987
 Type:  defect| Status:  needs_review
 Priority:  Medium|  Milestone:  Tor: 0.3.4.x-final
Component:  Core Tor/Tor  |Version:  Tor: unspecified
 Severity:  Normal| Resolution:
 Keywords:  fast-fix  |  Actual Points:
Parent ID:  #26196| Points:
 Reviewer:|Sponsor:
--+
Changes (by rl1987):

 * status:  accepted => needs_review


Comment:

 https://github.com/torproject/tor/pull/136

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #26284 [Core Tor/Tor]: Out-of-bounds smartlist access in protover_compute_vote()

[Tor Bug Tracker & Wiki]

#26284: Out-of-bounds smartlist access in protover_compute_vote()
--+
 Reporter:  rl1987|  Owner:  rl1987
 Type:  defect| Status:  accepted
 Priority:  Medium|  Milestone:  Tor: 0.3.4.x-final
Component:  Core Tor/Tor  |Version:  Tor: unspecified
 Severity:  Normal| Resolution:
 Keywords:  fast-fix  |  Actual Points:
Parent ID:  #26196| Points:
 Reviewer:|Sponsor:
--+
Changes (by nickm):

 * keywords:   => fast-fix
 * milestone:  Tor: 0.3.5.x-final => Tor: 0.3.4.x-final


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #26284 [Core Tor/Tor]: Out-of-bounds smartlist access in protover_compute_vote()

[Tor Bug Tracker & Wiki]

#26284: Out-of-bounds smartlist access in protover_compute_vote()
--+
 Reporter:  rl1987|  Owner:  rl1987
 Type:  defect| Status:  accepted
 Priority:  Medium|  Milestone:  Tor: 0.3.5.x-final
Component:  Core Tor/Tor  |Version:  Tor: unspecified
 Severity:  Normal| Resolution:
 Keywords:|  Actual Points:
Parent ID:  #26196| Points:
 Reviewer:|Sponsor:
--+
Changes (by rl1987):

 * status:  new => accepted
 * owner:  (none) => rl1987


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #26284 [Core Tor/Tor]: Out-of-bounds smartlist access in protover_compute_vote()

[Tor Bug Tracker & Wiki]

#26284: Out-of-bounds smartlist access in protover_compute_vote()
--+
 Reporter:  rl1987|  Owner:  (none)
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:  Tor: 0.3.5.x-final
Component:  Core Tor/Tor  |Version:  Tor: unspecified
 Severity:  Normal|   Keywords:
Actual Points:|  Parent ID:  #26196
   Points:|   Reviewer:
  Sponsor:|
--+
 When compiled with `DEBUG_SMARTLIST`:

 {{{
 dir/v3_networkstatus: [forking] Jun 03 15:26:03.147 [err]
 tor_assertion_failed_: Bug: ./src/common/container.h:70: smartlist_get:
 Assertion sl->num_used > idx failed; aborting. (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.151 [err] Bug: Assertion sl->num_used > idx failed in
 smartlist_get at ./src/common/container.h:70. Stack trace: (on Tor 0.3.4.1
 -alpha-dev b32d8d6025fdc1be)
 Jun 03 15:26:03.151 [err] Bug: 0   test
 0x00010ffdb108 log_backtrace + 72 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.152 [err] Bug: 1   test
 0x000110053771 tor_assertion_failed_ + 385 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.152 [err] Bug: 2   test
 0x00010fdd9a7a smartlist_get + 490 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.152 [err] Bug: 3   test
 0x00010fdd8013 protover_compute_vote + 3315 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.153 [err] Bug: 4   test
 0x00010ff41617 networkstatus_compute_consensus + 8823 (on Tor 0.3.4.1
 -alpha-dev b32d8d6025fdc1be)
 Jun 03 15:26:03.153 [err] Bug: 5   test
 0x00010f76ac5a test_a_networkstatus + 13930 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.154 [err] Bug: 6   test
 0x00010fa20684 testcase_run_bare_ + 308 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.154 [err] Bug: 7   test
 0x00010fa203bc testcase_run_one + 2924 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.154 [err] Bug: 8   test
 0x00010fa21e31 tinytest_main + 2321 (on Tor 0.3.4.1-alpha-dev
 b32d8d6025fdc1be)
 Jun 03 15:26:03.155 [err] Bug: 9   test
 0x00010fa1dffa main + 2218 (on Tor 0.3.4.1-alpha-dev b32d8d6025fdc1be)
 Jun 03 15:26:03.155 [err] Bug: 10  libdyld.dylib
 0x7fff6619f015 start + 1 (on Tor 0.3.4.1-alpha-dev b32d8d6025fdc1be)
 Jun 03 15:26:03.155 [err] Bug: 11  ???
 0x0001 0x0 + 1 (on Tor 0.3.4.1-alpha-dev b32d8d6025fdc1be)
 [Lost connection!]
   [v3_networkstatus FAILED]
 }}}

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs