[tor-bugs] #4230 [Tor Client]: smartlist functions contain bogus overflow checks

[Tor Bug Tracker & Wiki]

#4230: smartlist functions contain bogus overflow checks
------------------------+---------------------------------------------------
 Reporter:  rransom     |          Owner:                    
     Type:  defect      |         Status:  needs_review      
 Priority:  major       |      Milestone:  Tor: 0.2.1.x-final
Component:  Tor Client  |        Version:                    
 Keywords:              |         Parent:                    
   Points:              |   Actualpoints:                    
------------------------+---------------------------------------------------
Changes (by nickm):

  * status:  new => needs_review


Comment:

 Looking at the patch, I think it's just going to overflow again.  Sure, it
 caps sl->capacity at INT_MAX, but look at the tor_realloc() call: it
 reallocates the buffer to be equal to sizeof(void*)*sl->capacity.  So on a
 32-bit system, that'll be ((size_t)4)*INT_MAX , which isn't a sensible
 thing to say.

 Have a look at branch "bug4230" in my public repository; does that look
 okay to you?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4230#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online