summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-04-17Merge branch 'maint-0.4.0'teor
2019-04-17Merge branch 'maint-0.3.5' into maint-0.4.0teor
2019-04-16Merge remote-tracking branch 'tor-github/pr/910'Nick Mathewson
2019-04-16Merge remote-tracking branch 'tor-github/pr/884'Nick Mathewson
2019-04-15Merge branch 'tor-github/pr/941'George Kadianakis
2019-04-15Merge branch 'maint-0.4.0'George Kadianakis
2019-04-15Merge branch 'tor-github/pr/948' into maint-0.4.0George Kadianakis
2019-04-15Merge branch 'rust-panic1-035' into rust-panic1-040teor
2019-04-15Merge branch 'rust-panic1-034' into rust-panic1-035teor
Trivial merge: a blank line was removed between 0.3.4 and 0.3.5.
2019-04-15Merge branch 'rust-panic1' into rust-panic1-034teor
2019-04-12changes: file for 30117teor
2019-04-12Travis: expand "make test-stem", so timelimit can signal python on timeoutteor
Unlike kill, timelimit can only signal the process it launches. So we need timelimit to launch python, not make. Closes ticket 30117; diagnostic for 29437.
2019-04-12Merge branch 'tor-github/pr/908'George Kadianakis
2019-04-12Merge branch 'tor-github/pr/754'George Kadianakis
2019-04-12crypt_ops: Stop using a separate buffer in ed25519_signature_from_base64()teor
Part of 29960.
2019-04-11forward-port the 0.4.0.4-rc changelogNick Mathewson
2019-04-11Merge branch 'maint-0.4.0'Nick Mathewson
2019-04-11bump to 0.4.0.4-rc-devNick Mathewson
2019-04-11Merge remote-tracking branch 'tor-github/pr/913'Nick Mathewson
2019-04-11Merge remote-tracking branch 'tor-github/pr/887'Nick Mathewson
2019-04-11Merge remote-tracking branch 'tor-github/pr/741'Nick Mathewson
2019-04-11Travis: use stem backtrace signals with timelimitteor
Part of 30117.
2019-04-10Merge branch 'maint-0.4.0'Nick Mathewson
2019-04-10Bump version to 0.4.0.4-rcNick Mathewson
2019-04-10Merge branch 'maint-0.4.0'Nick Mathewson
2019-04-10Merge remote-tracking branch 'tor-github/pr/926' into maint-0.4.0Nick Mathewson
2019-04-10Add changes file for #30040.George Kadianakis
2019-04-10Prevent double free on huge files with 32 bit.Tobias Stoeckmann
The function compat_getdelim_ is used for tor_getline if tor is compiled on a system that lacks getline and getdelim. These systems should be very rare, considering that getdelim is POSIX. If this system is further a 32 bit architecture, it is possible to trigger a double free with huge files. If bufsiz has been already increased to 2 GB, the next chunk would be 4 GB in size, which wraps around to 0 due to 32 bit limitations. A realloc(*buf, 0) could be imagined as "free(*buf); return malloc(0);" which therefore could return NULL. The code in question considers that an error, but will keep the value of *buf pointing to already freed memory. The caller of tor_getline() would free the pointer again, therefore leading to a double free. This code can only be triggered in dirserv_read_measured_bandwidths with a huge measured bandwith list file on a system that actually allows to reach 2 GB of space through realloc. It is not possible to trigger this on Linux with glibc or other major *BSD systems even on unit tests, because these systems cannot reach so much memory due to memory fragmentation. This patch is effectively based on the penetration test report of cure53 for curl available at https://cure53.de/pentest-report_curl.pdf and explained under section "CRL-01-007 Double-free in aprintf() via unsafe size_t multiplication (Medium)".
2019-04-10practracker: accept 4 extra lines due to 30041teor
2019-04-10Merge branch 'maint-0.4.0'teor
2019-04-10Merge remote-tracking branch 'tor-github/pr/920' into maint-0.4.0teor
2019-04-09Merge branch 'maint-0.4.0'Nick Mathewson
2019-04-09Merge branch 'bug29922_035' into maint-0.4.0Nick Mathewson
2019-04-09Actually I believe this should be an EINVAL.Nick Mathewson
2019-04-09Changes file for bug30041Nick Mathewson
2019-04-09Check return value of buf_move_to_buf for error.Tobias Stoeckmann
If the concatenation of connection buffer and the buffer of linked connection exceeds INT_MAX bytes, then buf_move_to_buf returns -1 as an error value. This value is currently casted to size_t (variable n_read) and will erroneously lead to an increasement of variable "max_to_read". This in turn can be used to call connection_buf_read_from_socket to store more data inside the buffer than expected and clogging the connection buffer. If the linked connection buffer was able to overflow INT_MAX, the call of buf_move_to_buf would have previously internally triggered an integer overflow, corrupting the state of the connection buffer. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
2019-04-09Protect buffers against INT_MAX datalen overflows.Tobias Stoeckmann
Many buffer functions have a hard limit of INT_MAX for datalen, but this limitation is not enforced in all functions: - buf_move_all may exceed that limit with too many chunks - buf_move_to_buf exceeds that limit with invalid buf_flushlen argument - buf_new_with_data may exceed that limit (unit tests only) This patch adds some annotations in some buf_pos_t functions to guarantee that no out of boundary access could occur even if another function lacks safe guards against datalen overflows. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
2019-04-09Merge branch 'maint-0.4.0'George Kadianakis
2019-04-09Merge branch 'tor-github/pr/915' into maint-0.4.0George Kadianakis
2019-04-09Merge branch 'maint-0.4.0'teor
2019-04-09Merge remote-tracking branch 'tor-github/pr/866'teor
2019-04-09Merge remote-tracking branch 'tor-github/pr/862'teor
2019-04-09Merge remote-tracking branch 'tor-github/pr/892' into maint-0.4.0teor
2019-04-09manpage: Clarify that Tor does stream isolation between *Port listeners by ↵rl1987
default cherry-pick of tor-github/pr/841 to maint-0.4.0.
2019-04-08Detect and suppress an additional gmtime() warning in test_util.cNick Mathewson
Fixes bug 29922; bugfix on 0.2.9.3-alpha when we tried to capture all these warnings. No need to backport any farther than 0.3.5, though -- these warnings don't cause test failures before then. This one was tricky to find because apparently it only happened on _some_ windows builds.
2019-04-08Fix SC2006 in minimize.shrl1987
2019-04-06practracker: accept 6 extra lines in tortls_nss.c:tor_tls_context_new()teor
These lines were added to fix bug 29241.
2019-04-06Merge branch 'maint-0.4.0'teor
2019-04-06Merge remote-tracking branch 'tor-github/pr/911' into maint-0.4.0teor
2019-04-06changes: Ticket 29241 is actually a bug on NSS in 0.3.5.1-alphateor
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion