[tor-bugs] #15901 [Tor]: apparent memory corruption -- very difficult to isolate

[Tor Bug Tracker & Wiki]

#15901: apparent memory corruption -- very difficult to isolate
---------------------------+--------------------------------
     Reporter:  starlight  |      Owner:
         Type:  defect     |     Status:  new
     Priority:  critical   |  Milestone:  Tor: 0.2.7.x-final
    Component:  Tor        |    Version:  Tor: 0.2.6.10
   Resolution:             |   Keywords:
Actual Points:             |  Parent ID:
       Points:             |
---------------------------+--------------------------------

Comment (by starlight):

 If the pre-inflate data still exists in the
 core file I'll extract it and see what
 `infgen` makes of it.  However my guess
 is that it was inflated-on-the-fly so that
 may not be possible.

 While the theory that the actual compressed
 data is triggering the problem has appeal,
 I think either this isn't the problem
 or that the result is a persistent
 broken state.  Once the relay gets in the
 bad state it never recovers.  Have let it
 run for two-or-three consensus cycles at
 times so this supports a bad memory state
 over a bad document--unless of course
 it's a bad document that results in a
 bad memory state.

 So I'll go ahead and build zlib with
 ASAN+UBSAN in the hope this will catch
 the problem.  Have not run with zlib
 instrumented thus far.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/15901#comment:31>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online