[tor-bugs] #6765 [Tor Client]: Defensive programming: Use tor_malloc_zero() in var_cell_new()

[Tor Bug Tracker & Wiki]

#6765: Defensive programming: Use tor_malloc_zero() in var_cell_new()
------------------------+---------------------------------------------------
 Reporter:  asn         |          Owner:                    
     Type:  defect      |         Status:  new               
 Priority:  normal      |      Milestone:  Tor: 0.2.4.x-final
Component:  Tor Client  |        Version:                    
 Keywords:              |         Parent:                    
   Points:              |   Actualpoints:                    
------------------------+---------------------------------------------------
 To be sure that we don't leak any memory to the network (a la
 CVE-2011-4576), it would be good if we used `tor_malloc_zero()` in
 `var_cell_new()`. We currently use `tor_malloc()` which does not clean
 memory.

 We currently seem to be setting `var_cell_t.payload` and
 `var_cell_t.payload_len` correctly before calls to
 `connection_or_write_var_cell_to_buf()`, but it would be good to future-
 proof ourselves.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/6765>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online