tor

commit 7660a7cf7d4191e44aba0bf3e02a001d7e979d29
parent 511aeba8eeb24a953228e00917f64703059a7673
Author: teor <teor@torproject.org>
Date:   Wed, 23 Oct 2019 08:20:45 +1000

Merge remote-tracking branch 'tor-github/pr/1178' into maint-0.2.9

Diffstat:
A
changes/ticket31001
 | 
6
++++++
M
src/common/compat.c
 | 
8
++++----

2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/changes/ticket31001 b/changes/ticket31001
@@ -0,0 +1,6 @@
+  o Minor bugfixes (compatibility, standards compliance):
+    - Fix a bug that would invoke undefined behavior on certain operating
+      systems when trying to asprintf() a string exactly INT_MAX bytes
+      long. We don't believe this is exploitable, but it's better
+      to fix it anyway. Fixes bug 31001; bugfix on 0.2.2.11-alpha.
+      Found and fixed by Tobias Stoeckmann.
diff --git a/src/common/compat.c b/src/common/compat.c
@@ -542,8 +542,8 @@ tor_vasprintf(char **strp, const char *fmt, va_list args)
     *strp = NULL;
     return -1;
   }
-  strp_tmp = tor_malloc(len + 1);
-  r = _vsnprintf(strp_tmp, len+1, fmt, args);
+  strp_tmp = tor_malloc((size_t)len + 1);
+  r = _vsnprintf(strp_tmp, (size_t)len+1, fmt, args);
   if (r != len) {
     tor_free(strp_tmp);
     *strp = NULL;
@@ -578,9 +578,9 @@ tor_vasprintf(char **strp, const char *fmt, va_list args)
     *strp = tor_strdup(buf);
     return len;
   }
-  strp_tmp = tor_malloc(len+1);
+  strp_tmp = tor_malloc((size_t)len+1);
   /* use of tor_vsnprintf() will ensure string is null terminated */
-  r = tor_vsnprintf(strp_tmp, len+1, fmt, args);
+  r = tor_vsnprintf(strp_tmp, (size_t)len+1, fmt, args);
   if (r != len) {
     tor_free(strp_tmp);
     *strp = NULL;