[tor-commits] [tor/release-0.3.5] Add changes file for #30040.

[teor at torproject.org]

commit 2cdc6b2005d2ad09b44cf9a455a70f258e7f6fca
Author: George Kadianakis <desnacked at riseup.net>
Date:   Tue Apr 9 17:30:14 2019 +0300

    Add changes file for #30040.
---
 changes/bug30040 | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/changes/bug30040 b/changes/bug30040
new file mode 100644
index 000000000..7d80528a1
--- /dev/null
+++ b/changes/bug30040
@@ -0,0 +1,9 @@
+  o Minor bugfixes (security):
+    - Fix a potential double free bug when reading huge bandwidth files. The
+      issue is not exploitable in the current Tor network because the
+      vulnerable code is only reached when directory authorities read bandwidth
+      files, but bandwidth files come from a trusted source (usually the
+      authorities themselves). Furthermore, the issue is only exploitable in
+      rare (non-POSIX) 32-bit architectures which are not used by any of the
+      current authorities. Fixes bug 30040; bugfix on 0.3.5.1-alpha. Bug found
+      and fixed by Tobias Stoeckmann.