#24423: Fix STACK warnings in Tor -----------------------------+------------------------------------ Reporter: nickm | Owner: nickm Type: defect | Status: needs_revision Priority: Medium | Milestone: Tor: 0.3.3.x-final Component: Core Tor/Tor | Version: Severity: Normal | Resolution: Keywords: review-group-27 | Actual Points: Parent ID: | Points: Reviewer: catalyst | Sponsor: -----------------------------+------------------------------------
Comment (by nickm): Here's the remaining issue: {{{ bug: anti-dce model: | sw.default.i: %.b.i =3D load i1* @networkstatus_get_flavor_name.warning_logged__, !dbg !1116 br i1 %.b.i, label %if.end.i, label %if.then.i, !dbg !1121, !macro !1123 stack: - /home/thomas/Arbeit/hardening/stack/build36/tor_test/../../../../Tor/tor/src/or/networkstatus.c:2052:34 ncore: 1 core: - /home/thomas/Arbeit/hardening/stack/build36/tor_test/../../../../Tor/tor/src/or/networkstatus.c:2049:28 - buffer overflow }}} and here's the code, with the lines marked. {{{ for (i=0; i<N_CONSENSUS_FLAVORS; ++i) { consensus_waiting_for_certs_t *waiting = &consensus_waiting_for_certs[i]; if (!waiting->consensus) continue; if (networkstatus_check_consensus_signature(waiting->consensus, 0)>=0) { char *waiting_body = waiting->body; // 2049 if (!networkstatus_set_current_consensus( waiting_body, networkstatus_get_flavor_name(i), // 2052 NSSET_WAS_WAITING_FOR_CERTS, source_dir)) { tor_free(waiting_body); } } }}} What's I think is happening here is that the compiler sees that `waiting->body` is computed, and so realizes that "i" must be in range 0 <= i < N_CONSENSUS_FLAVORS. This could be used to eliminate the assertion and default case in networkstatus_get_flavor_name() when it's inlined. -- Ticket URL: <https://trac.torproject.org/projects/tor/ticket/24423#comment:29> Tor Bug Tracker & Wiki <https://trac.torproject.org/> The Tor Project: anonymity online
_______________________________________________ tor-bugs mailing list tor-bugs@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs