diff options
| author | Nick Mathewson <nickm@torproject.org> | 2012-05-07 12:44:34 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2012-05-07 12:47:13 -0400 |
| commit | d9ba9f91d25210f10f740d243899dbe99f8acb60 (patch) | |
| tree | eb7d360e25ae067f25aa3d20ea2aa13c913839cf /src/or | |
| parent | c8a0cceae279eb2b27c51a358e00942a9967ca77 (diff) | |
| download | tor-d9ba9f91d25210f10f740d243899dbe99f8acb60.tar.gz tor-d9ba9f91d25210f10f740d243899dbe99f8acb60.zip | |
Detect out-of-bounds bwweightscale values early in the voting process
If the authorities agreed on a sufficiently bad bwweightscale value
(<=0 or == INT32_MAX), the bandwidth algorithm could make the voters
assert while computing the consensus.
Fix for bug5786; bugfix on 0.2.2.17-alpha
Diffstat (limited to 'src/or')
| -rw-r--r-- | src/or/dirvote.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 4848917b21..20dc8c2649 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -1005,7 +1005,7 @@ networkstatus_compute_bw_weights_v10(smartlist_t *chunks, int64_t G, /* We cast down the weights to 32 bit ints on the assumption that * weight_scale is ~= 10000. We need to ensure a rogue authority * doesn't break this assumption to rig our weights */ - tor_assert(0 < weight_scale && weight_scale < INT32_MAX); + tor_assert(0 < weight_scale && weight_scale <= INT32_MAX); /* * Provide Wgm=Wgg, Wmm=1, Wem=Wee, Weg=Wed. May later determine @@ -1233,7 +1233,7 @@ networkstatus_compute_bw_weights_v9(smartlist_t *chunks, int64_t G, int64_t M, /* We cast down the weights to 32 bit ints on the assumption that * weight_scale is ~= 10000. We need to ensure a rogue authority * doesn't break this assumption to rig our weights */ - tor_assert(0 < weight_scale && weight_scale < INT32_MAX); + tor_assert(0 < weight_scale && weight_scale <= INT32_MAX); if (Wgg < 0 || Wgg > weight_scale) { log_warn(LD_DIR, "Bw %s: Wgg="I64_FORMAT"! G="I64_FORMAT @@ -2019,7 +2019,7 @@ networkstatus_compute_consensus(smartlist_t *votes, int ok=0; char *eq = strchr(bw_weight_param, '='); if (eq) { - weight_scale = tor_parse_long(eq+1, 10, INT32_MIN, INT32_MAX, &ok, + weight_scale = tor_parse_long(eq+1, 10, 1, INT32_MAX, &ok, NULL); if (!ok) { log_warn(LD_DIR, "Bad element '%s' in bw weight param", |