tor

commit 6dba86d7c92d25b5a6eedd0dbd75dc466dcaa43a
parent 142612bd16f47c9ebe9ac50bc394b07c1026574b
Author: David Goulet <dgoulet@torproject.org>
Date:   Mon, 29 Jul 2019 12:02:54 -0400

Merge branch 'maint-0.4.1'

Diffstat:
A
changes/ticket31001
 | 
6
++++++
M
src/lib/string/printf.c
 | 
8
++++----

2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/changes/ticket31001 b/changes/ticket31001
@@ -0,0 +1,6 @@
+  o Minor bugfixes (compatibility, standards compliance):
+    - Fix a bug that would invoke undefined behavior on certain operating
+      systems when trying to asprintf() a string exactly INT_MAX bytes
+      long. We don't believe this is exploitable, but it's better
+      to fix it anyway. Fixes bug 31001; bugfix on 0.2.2.11-alpha.
+      Found and fixed by Tobias Stoeckmann.
diff --git a/src/lib/string/printf.c b/src/lib/string/printf.c
@@ -117,8 +117,8 @@ tor_vasprintf(char **strp, const char *fmt, va_list args)
     *strp = NULL;
     return -1;
   }
-  strp_tmp = tor_malloc(len + 1);
-  r = _vsnprintf(strp_tmp, len+1, fmt, args);
+  strp_tmp = tor_malloc((size_t)len + 1);
+  r = _vsnprintf(strp_tmp, (size_t)len+1, fmt, args);
   if (r != len) {
     tor_free(strp_tmp);
     *strp = NULL;
@@ -153,9 +153,9 @@ tor_vasprintf(char **strp, const char *fmt, va_list args)
     *strp = tor_strdup(buf);
     return len;
   }
-  strp_tmp = tor_malloc(len+1);
+  strp_tmp = tor_malloc((size_t)len+1);
   /* use of tor_vsnprintf() will ensure string is null terminated */
-  r = tor_vsnprintf(strp_tmp, len+1, fmt, args);
+  r = tor_vsnprintf(strp_tmp, (size_t)len+1, fmt, args);
   if (r != len) {
     tor_free(strp_tmp);
     *strp = NULL;