Opened 7 years ago

Closed 7 years ago

#9980 closed defect (duplicate)

(cp >= end) in channel_tls_process_netinfo_cell confuses analysis tools

Reported by: nickm Owned by:
Priority: Medium Milestone: Tor: 0.2.5.x-final
Component: Core Tor/Tor Version:
Severity: Keywords: tor-client
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

David Fifield reports that:

  my_addr_len = (uint8_t) cell->payload[5];
  end = cell->payload + CELL_PAYLOAD_SIZE;
  cp = cell->payload + 6 + my_addr_len;
  if (cp >= end) {
    ...
    return;
  }

confuses the STACK analysis tool because the check could get optimized away. This check is indeed needless, since CELL_PAYLOAD_SIZE is 509, but UINT8_MAX + 6 is only 261, so that branch can never be taken. Shall we just remove it?

Child Tickets

Change History (2)

comment:1 Changed 7 years ago by dcf

Was also reported in #10313, with a patch.

comment:2 Changed 7 years ago by nickm

Resolution: duplicate
Status: newclosed

Closing as duplicate.

Note: See TracTickets for help on using tickets.