[tor-bugs] #2326 [Tor Relay]: carefully crafted cache file sizes can trigger assert

[Tor Bug Tracker & Wiki]

#2326: carefully crafted cache file sizes can trigger assert
-----------------------+----------------------------------------------------
 Reporter:  arma       |       Owner:                    
     Type:  defect     |      Status:  new               
 Priority:  major      |   Milestone:  Tor: 0.2.1.x-final
Component:  Tor Relay  |     Version:                    
 Keywords:             |      Parent:                    
-----------------------+----------------------------------------------------
 In read_file_to_str() we do
 {{{
   if ((uint64_t)(statbuf.st_size)+1 > SIZE_T_CEILING)
     return NULL;

   string = tor_malloc((size_t)(statbuf.st_size+1));
 }}}

 So a remote attacker who can give you a combination of cached blobs such
 that one of your files becomes exactly SIZE_T_CEILING bytes (just 2 gigs
 on a 32 bit platform) could cause your Tor to consistently assert on
 start.

 The fix is to check >= instead of >.

 Reported by doors.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2326>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online