Opened 7 years ago

Closed 7 years ago

#7014 closed defect (fixed)

fmt_addr used more than once in parameter lists

Reported by: dcf Owned by:
Priority: Medium Milestone: Tor: 0.2.3.x-final
Component: Core Tor/Tor Version:
Severity: Keywords:
Cc: asn Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

fmt_addr is called twice as an argument to log_notice, in two places in transport_resolve_conflicts. Maybe other places too. Because fmt_addr writes to a static buffer, one call clobbers the result of the other.

With this torrc,

ClientTransportPlugin dummy socks4 1.1.1.1:10001
ClientTransportPlugin dummy socks4 2.2.2.2:10001
Log "notice stderr"

you get the log (observe wrongly repeated address)

[notice] You tried to add transport 'dummy' at '2.2.2.2:10001' but the same transport already exists at '2.2.2.2:10001'. Skipping.

Child Tickets

Change History (8)

comment:1 Changed 7 years ago by arma

Milestone: Tor: 0.2.3.x-final

comment:2 Changed 7 years ago by arma

Cc: asn added

comment:3 Changed 7 years ago by asn

Status: newneeds_review

Nice catch! How about branch bug7014 in https://git.gitorious.org/mytor/mytor.git?

(It's on gitorious because I don't have my git.tpo keys currently with me.)

comment:4 Changed 7 years ago by asn

Also see bug7014_023 for the maint-0.2.3 fix.

comment:5 in reply to:  3 Changed 7 years ago by dcf

Replying to asn:

Nice catch! How about branch bug7014 in https://git.gitorious.org/mytor/mytor.git?

(It's on gitorious because I don't have my git.tpo keys currently with me.)

I grepped and didn't find any other instances of this problem.

comment:6 Changed 7 years ago by nickm

Status: needs_reviewneeds_revision

bug7014_023 is iffy: it never calls the tor_free(new_transport_addr) when the function returns -1.

comment:7 in reply to:  6 Changed 7 years ago by asn

Status: needs_revisionneeds_review

Replying to nickm:

bug7014_023 is iffy: it never calls the tor_free(new_transport_addr) when the function returns -1.

Sloppy me. Please see again.

comment:8 Changed 7 years ago by nickm

Resolution: fixed
Status: needs_reviewclosed

Squashed and merged into 0.2.3 and 0.2.4. Thanks!

Note: See TracTickets for help on using tickets.