Opened 6 years ago

Closed 6 years ago

#12928 closed enhancement (fixed)

Review of 197d8550094d0509bed9e682b4a7b723dd948141

Reported by: mymyselfandu Owned by:
Priority: Low Milestone: Tor: 0.2.6.x-final
Component: Core Tor/Tor Version: Tor: unspecified
Severity: Keywords:
Cc: rl1987 Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

File is src/or/entrynodes.c , function entry_is_time_to_retry

Why isn' t the loop guarded with i < 3?

It looks for security code dangerous to let the stop of the loop depend on a parameter of the function if the table is fixed in size.

Child Tickets

Attachments (1)

0001-Bounds-check-while-looping-over-a-fixed-size-table-o.patch (1.7 KB) - added by mymyselfandu 6 years ago.
Patch with ARRAY_SIZE as proposed by upstream developer

Download all attachments as: .zip

Change History (4)

comment:1 Changed 6 years ago by nickm

Milestone: Tor: 0.2.6.x-final
Priority: normalminor

Good point; patches welcome. Using an appropriate ARRAY_SIZE macro (eg #define ARRAY_SIZE(a) (sizeof(a)/sizeof((a)[0])) ) would make the code even more clear IMO.

comment:2 Changed 6 years ago by nickm

Cc: rl1987 added

Changed 6 years ago by mymyselfandu

Patch with ARRAY_SIZE as proposed by upstream developer

comment:3 Changed 6 years ago by nickm

Resolution: fixed
Status: newclosed

Hang on; there's already an ARRAY_LENGTH in util.h. Tweaking the patch to use that instead and merging it. Thanks!

Note: See TracTickets for help on using tickets.