diff options
| author | Nick Mathewson <nickm@torproject.org> | 2017-01-22 11:32:54 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2017-01-23 08:47:10 -0500 |
| commit | 767516680c03dfcd145033eff66fa3b0ca7d4b5b (patch) | |
| tree | 6a077381ce30af993967e9467e53d79ee26d81fa /changes/trove-2017-001 | |
| parent | 698df98837aefc2b896b70e43218d8c7fd8c5910 (diff) | |
| download | tor-767516680c03dfcd145033eff66fa3b0ca7d4b5b.tar.gz tor-767516680c03dfcd145033eff66fa3b0ca7d4b5b.zip | |
TROVE-2017-001 : move -ftrapv back into --expensive-hardening.
Diffstat (limited to 'changes/trove-2017-001')
| -rw-r--r-- | changes/trove-2017-001 | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/changes/trove-2017-001 b/changes/trove-2017-001 new file mode 100644 index 0000000000..5187e6d5f1 --- /dev/null +++ b/changes/trove-2017-001 @@ -0,0 +1,8 @@ + o Major bugfixes (security): + - Downgrade the "-ftrapv" option from "always on" to "only on when + --enable-expensive-hardening is provided." This hardening option, like + others, can turn survivable bugs into crashes--and having it on by + default made a (relatively harmless) integer overflow bug into a + denial-of-service bug. Fixes bug 21278 (TROVE-2017-001); bugfix on + 0.2.9.1-alpha. + |