aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
* Fix a couple of non-cleared key issues in hidden servicesNick Mathewson2011-01-15
| | | | we need to do more hunting, but this fixes the ones mentioned in 2385.
* Zero out some more key data before freeing itNick Mathewson2011-01-15
| | | | Found by cypherpunks; fixes bug 2384.
* Merge branch 'bug2352_obsize' into maint-0.2.1Nick Mathewson2011-01-15
|\
| * catch another overlong malloc possibility. found by cypherpunksNick Mathewson2011-01-15
| |
| * Impose maximum sizes on parsed objectsNick Mathewson2011-01-10
| | | | | | | | | | | | | | | | | | An object, you'll recall, is something between -----BEGIN----- and -----END----- tags in a directory document. Some of our code, as doorss has noted in bug 2352, could assert if one of these ever overflowed SIZE_T_CEILING but not INT_MAX. As a solution, I'm setting a maximum size on a single object such that neither of these limits will ever be hit. I'm also fixing the INT_MAX checks, just to be sure.
| * Add logic in routerparse to not read overlong private keysNick Mathewson2011-01-10
| | | | | | | | | | I am not at all sure that it is possible to trigger a bug here, but better safe than sorry.
* | Add missing check for hostname answer_len in dnsserv sizeNick Mathewson2011-01-15
| | | | | | | | This is checked elsewhere too, but let's be RFC-conformant.
* | Merge branch 'bug2324_uncompress' into maint-0.2.1Nick Mathewson2011-01-15
|\ \
| * | clean up message; explain a magic number in a commentNick Mathewson2011-01-15
| | |
| * | Fix a SIZE_T_CEILING check in torgzip.c; noticed by cypherpunksNick Mathewson2011-01-05
| | |
| * | Detect and disallow compression bombsNick Mathewson2011-01-03
| | |
* | | Fix a heap overflow found by debuger, and make it harder to make that ↵Nick Mathewson2011-01-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | mistake again Our public key functions assumed that they were always writing into a large enough buffer. In one case, they weren't. (Incorporates fixes from sebastian)
* | | Always nul-terminate the result passed to evdns_server_add_ptr_replyNick Mathewson2011-01-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In dnsserv_resolved(), we carefully made a nul-terminated copy of the answer in a PTR RESOLVED cell... then never used that nul-terminated copy. Ouch. Surprisingly this one isn't as huge a security problem as it could be. The only place where the input to dnsserv_resolved wasn't necessarily nul-terminated was when it was called indirectly from relay.c with the contents of a relay cell's payload. If the end of the payload was filled with junk, eventdns.c would take the strdup() of the name [This part is bad; we might crash there if the cell is in a bad part of the stack or the heap] and get a name of at least length 495[*]. eventdns.c then rejects any name of length over 255, so the bogus data would be neither transmitted nor altered. [*] If the name was less than 495 bytes long, the client wouldn't actually be reading off the end of the cell. Nonetheless this is a reasonably annoying bug. Better fix it. Found while looking at bug 2332, reported by doorss. Bugfix on 0.2.0.1-alpha.
* | | Make our replacement INT32_MAX always signedNick Mathewson2011-01-12
| | | | | | | | | | | | | | | | | | | | | The C standard says that INT32_MAX is supposed to be a signed integer. On platforms that have it, we get the correct platform-defined value. Our own replacement, however, was unsigned. That's going to cause a bug somewhere eventually.
* | | Update to the January 1 2011 Maxmind GeoLite Country database.Karsten Loesing2011-01-10
| |/ |/|
* | Remove a loud info log messageNick Mathewson2011-01-07
| |
* | Correctly detect and exclude addresses outside of our virtual address rangeNick Mathewson2011-01-07
| | | | | | | | | | Found by cypherpunks; fixes more of 2328. Bug was introduced in 3623a122; first appeared in 0.2.0.5-alpha.
* | Merge branch 'bug2328_021' into maint-0.2.1Nick Mathewson2011-01-06
|\ \ | |/ |/|
| * Notice a little faster if we're running out of virtual addressesNick Mathewson2011-01-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We were not decrementing "available" every time we did ++next_virtual_addr in addressmap_get_virtual_address: we left out the --available when we skipped .00 and .255 addresses. This didn't actually cause a bug in most cases, since the failure mode was to keep looping around the virtual addresses until we found one, or until available hit zero. It could have given you an infinite loop rather than a useful message, however, if you said "VirtualAddrNetwork 127.0.0.255/32" or something broken like that. Spotted by cypherpunks
| * Handle a NULL return from addressmap_get_virtual_addressNick Mathewson2011-01-05
| | | | | | | | Fix for bug 2328; bugfix on 0.1.2.1-alpha; bug found by doorss.
| * Fix a double-counting bug in addrmap_get_virtual_addressNick Mathewson2011-01-05
| | | | | | | | | | | | We were decrementing "available" twice for each in-use address we ran across. This would make us declare that we ran out of virtual addresses when the address space was only half full.
* | Avoid assertion on read_file_to_str() with size==SIZE_T_CEILING-1Nick Mathewson2011-01-03
| | | | | | | | Spotted by doors, fixes bug 2326.
* | Check size against SIZE_T_CEILING in realloc too.Nick Mathewson2011-01-03
| | | | | | | | Fixes bug 2324.
* | Never include pthread.h when building for Windows.Nick Mathewson2011-01-03
| | | | | | | | | | | | | | | | | | | | | | | | On Windows, we never use pthreads, since it doesn't usually exist, and when it does it tends to be a little weirdly-behaved. But some mingw installations have a pthreads installed, so autoconf detects pthread.h and tells us about it. This would make us include pthread.h, which could make for trouble when the iffy pthread.h tried to include config.h. This patch changes compat.h so that we never include pthread.h on Windows. Fixes bug 2313; bugfix on 0.1.0.1-rc.
* | fix whitespace issuesNick Mathewson2011-01-03
| |
* | Bump copyright statements to 2011Nick Mathewson2011-01-03
|/
* Merge remote branch 'public/bug2190_021' into maint-0.2.1Nick Mathewson2010-12-21
|\
| * Do not send Libevent log messages to a controller (0.2.1 backport)Nick Mathewson2010-11-19
| | | | | | | | | | | | | | | | | | | | Doing so could make Libevent call Libevent from inside a Libevent logging call, which is a recipe for reentrant confusion and hard-to-debug crashes. This would especially hurt if Libevent debug-level logging is enabled AND the user has a controller watching for low-severity log messages. Fix bug 2190; fix on 0.1.0.2-rc.
* | Merge commit 'nickm/fix_security_bug_021' into maint-0.2.1Roger Dingledine2010-12-16
|\ \
| * | Make payloads into uint8_t.Nick Mathewson2010-12-15
| | | | | | | | | | | | This will avoid some signed/unsigned assignment-related bugs.
| * | Have all of our allocation functions and a few others check for underflowNick Mathewson2010-12-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | It's all too easy in C to convert an unsigned value to a signed one, which will (on all modern computers) give you a huge signed value. If you have a size_t value of size greater than SSIZE_T_MAX, that is way likelier to be an underflow than it is to be an actual request for more than 2gb of memory in one go. (There's nothing in Tor that should be trying to allocate >2gb chunks.)
| * | Base SIZE_T_CEILING on SSIZE_T_MAX.Nick Mathewson2010-12-13
| | |
* | | Change gabelmoo's IP address and ports.Karsten Loesing2010-12-16
| | |
* | | Update to the December 1 2010 Maxmind GeoLite Country database.Karsten Loesing2010-12-08
|/ /
* | Fix compilation with mingw and OpenSSL 0.9.8m+mingw-san2010-11-23
| |
* | Use S_CASE for ehostunreach, not E_CASE. Partial backport of 69deb22f. Fixes ↵Nick Mathewson2010-11-23
| | | | | | | | 0.2.1 compilation on windows
* | Merge branch 'fix2204' into maint-0.2.1Nick Mathewson2010-11-21
|\ \ | |/ |/|
| * Do not set the hostname TLS extension server-side; only client-sideNick Mathewson2010-11-20
| | | | | | | | | | This may fix bug 2204, and resolve the incompatibility with openssl 0.9.8p/1.0.0b.
* | Disable logging to control port connections in buf_shrink_freelists.Robert Ransom2010-11-12
| | | | | | | | | | If buf_shrink_freelists calls log_warn for some reason, we don't want the log call itself to throw buf_shrink_freelists further off the rails.
* | Move the original log_info call out of the core of buf_shrink_freelists.Robert Ransom2010-11-12
|/ | | | | | | | Sending a log message to a control port can cause Tor to allocate a buffer, thereby changing the length of the freelist behind buf_shrink_freelists's back, thereby causing an assertion to fail. Fixes bug #1125.
* let unpublished bridges learn their ip address tooRoger Dingledine2010-11-11
|
* Enforce multiplicity rules when parsing annotations.Nick Mathewson2010-11-10
| | | | | | | | | We would never actually enforce multiplicity rules when parsing annotations, since the counts array never got entries added to it for annotations in the token list that got added by earlier calls to tokenize_string. Found by piebeer.
* Fix a bug where seting allow_annotations==0 only ignores annotations, but ↵Nick Mathewson2010-11-10
| | | | does not block them
* Update to the October 1 2010 Maxmind GeoLite Country database.Karsten Loesing2010-10-04
|
* actually retry bridges when your network goes awayRoger Dingledine2010-09-28
|
* Merge remote branch 'karsten/geoip-sep2010' into maint-0.2.1Nick Mathewson2010-09-08
|\
| * Update to the September 1 2010 Maxmind GeoLite Country database.Karsten Loesing2010-09-08
| |
* | Remove a needless keep_open_until_flushedNick Mathewson2010-09-08
| |
* | Close a non-open OR connection *only* after KeepalivePeriod.Nick Mathewson2010-09-03
|/ | | | | | | | | | | | | | | | | | | | When we introduced the code to close non-open OR connections after KeepalivePeriod had passed, we replaced some code that said if (!connection_is_open(conn)) { /* let it keep handshaking forever */ } else if (do other tests here) { ... with new code that said if (!connection_is_open(conn) && past_keepalive) { /* let it keep handshaking forever */ } else if (do other tests here) { ... This was a mistake, since it made all the other tests start applying to non-open connections, thus causing bug 1840, where non-open connections get closed way early. Fixes bug 1840. Bugfix on 0.2.1.26 (commit 67b38d50).
* Backport END_STREAM_REASON_NOROUTE for client use.Sebastian Hahn2010-08-18
| | | | (Partial backport of 150ed553dfce9, 161b275028e90, and 4c948ffd6.)
generated by cgit v1.2.3 (git 2.45.0) at 2025-03-01 13:20:59 +0000