torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity
18,971 Commits 53 Branches 631 Tags
0a78d2947cc1f7a0aa2ede2c37baec3e4c23a424
Commit Graph
3129 Commits
Author SHA1 Message Date
Nick Mathewson 0a78d2947c Merge branch 'maint-0.2.5' into release-0.2.5 2017-06-08 09:21:15 -04:00
Nick Mathewson dec7998f5c Merge branch 'maint-0.2.4' into maint-0.2.5 2017-06-08 09:21:15 -04:00
David Goulet 56a7c5bc15 TROVE-2017-005: Fix assertion failure in connection_edge_process_relay_cell 
On an hidden service rendezvous circuit, a BEGIN_DIR could be sent
(maliciously) which would trigger a tor_assert() because
connection_edge_process_relay_cell() thought that the circuit is an
or_circuit_t but is an origin circuit in reality.

Fixes #22494

Reported-by: Roger Dingledine <arma@torproject.org>
Signed-off-by: David Goulet <dgoulet@torproject.org>
 2017-06-08 09:21:10 -04:00
Nick Mathewson b104ea724d Merge branch 'maint-0.2.5' into release-0.2.5 2017-06-05 12:00:14 -04:00
Nick Mathewson 1a540b5792 Merge branch 'maint-0.2.4' into maint-0.2.5 2017-06-05 12:00:08 -04:00
Nick Mathewson e3ebae4804 Fix undefined behavior in geoip_parse_entry(). 
Fixes bug 22490; bugfix on 6a241ff3ff in 0.2.4.6-alpha.

Found by teor using clang-5.0's AddressSanitizer stack-use-after-scope.
 2017-06-05 10:09:39 -04:00
Nick Mathewson 33b69e6884 Merge branch 'maint-0.2.5' into release-0.2.5 2017-05-08 08:08:01 -04:00
Nick Mathewson 68d6720452 Merge branch 'maint-0.2.4' into maint-0.2.5 2017-05-08 08:06:59 -04:00
Karsten Loesing 5207e41ffe Update geoip and geoip6 to the May 2 2017 database. 2017-05-08 10:09:42 +02:00
Nick Mathewson 148d76c092 Merge branch 'maint-0.2.5' into release-0.2.5 2017-04-06 08:32:36 -04:00
Nick Mathewson a8a860e1da Merge branch 'maint-0.2.4' into maint-0.2.5 2017-04-06 08:31:12 -04:00
Karsten Loesing 9d7933296c Update geoip and geoip6 to the April 4 2017 database. 2017-04-06 10:52:39 +02:00
Nick Mathewson 51ca3dc811 Merge branch 'maint-0.2.5' into release-0.2.5 2017-03-08 10:10:36 -05:00
Nick Mathewson 933a1e7997 Merge branch 'maint-0.2.4' into maint-0.2.5 2017-03-08 10:10:29 -05:00
Karsten Loesing 4488c319dd Update geoip and geoip6 to the March 7 2017 database. 2017-03-08 09:41:35 +01:00
Nick Mathewson 7b1762481b Begin an 0.2.5.13 changelog 
To build this changelog, I've gone through the entries in
release-0.2.5's changes subdirectory, and looked up the ChangeLog
entry for each.  I have not sorted them yet.
 2017-02-23 15:50:27 -05:00
Nick Mathewson c0ff59f870 Merge branch 'maint-0.2.5' into release-0.2.5 2017-02-15 07:50:48 -05:00
Nick Mathewson a452b71395 Merge branch 'maint-0.2.4' into maint-0.2.5 2017-02-15 07:47:04 -05:00
Nick Mathewson 194e31057f Avoid integer underflow in tor_version_compare. 
Fix for TROVE-2017-001 and bug 21278.

(Note: Instead of handling signed ints "correctly", we keep the old
behavior, except for the part where we would crash with -ftrapv.)
 2017-02-14 16:10:27 -05:00
Roger Dingledine 635c5a8a92 be sure to remember the changes file for #20384 2017-02-13 15:22:36 -05:00
Nick Mathewson c0257f14cd Merge branch 'maint-0.2.5' into release-0.2.5 2017-02-13 14:39:13 -05:00
Nick Mathewson 124062e843 Merge branch 'maint-0.2.4' into maint-0.2.5 2017-02-13 14:37:01 -05:00
Karsten Loesing f6016058b4 Update geoip and geoip6 to the February 8 2017 database. 2017-02-12 15:56:31 +01:00
Nick Mathewson 2f6a66a174 Merge branch 'maint-0.2.5' into release-0.2.5 2017-02-07 10:39:50 -05:00
Nick Mathewson 2ce4330249 Merge remote-tracking branch 'public/bug18710_025' into maint-0.2.5 2017-02-07 10:37:43 -05:00
Nick Mathewson c056d19323 Merge branch 'maint-0.2.4' into maint-0.2.5 2017-02-07 10:37:31 -05:00
Nick Mathewson 457d38a6e9 Change behavior on missing/present event to warn instead of asserting. 
Add a changes file.
 2017-02-07 09:48:19 -05:00
Nick Mathewson 72d9e057c3 Merge branch 'maint-0.2.5' into release-0.2.5 2017-02-07 09:21:13 -05:00
Nick Mathewson b9ef21cf56 Merge branch 'maint-0.2.4' into maint-0.2.5 2017-02-07 09:17:59 -05:00
Nick Mathewson e4a42242ea Backport the tonga->bifroest move to 0.2.4. 
This is a backport of 19728 and 19690
 2017-02-07 09:15:21 -05:00
Nick Mathewson 9203b3e4ed Merge branch 'maint-0.2.5' into release-0.2.5 2017-02-07 08:56:39 -05:00
Nick Mathewson 6b37512dc7 Merge branch 'maint-0.2.4' into maint-0.2.5 2017-02-07 08:54:47 -05:00
Nick Mathewson d6eae78e29 Merge remote-tracking branch 'public/bug19152_024_v2' into maint-0.2.4 2017-02-07 08:47:11 -05:00
Nick Mathewson 2393e67b2e Merge branch 'maint-0.2.5' into release-0.2.5 2017-02-07 08:41:33 -05:00
Nick Mathewson 05ec055c41 Merge branch 'maint-0.2.4' into maint-0.2.5 2017-02-07 08:38:59 -05:00
Nick Mathewson 51675f97d3 Merge remote-tracking branch 'public/bug17404_024' into maint-0.2.4 2017-02-07 08:37:07 -05:00
Nick Mathewson 332543baed Merge branch 'maint-0.2.4' into maint-0.2.5 2017-02-07 08:34:08 -05:00
teor (Tim Wilson-Brown) fb7d1f41b4 Make memwipe() do nothing when passed a NULL pointer or zero size 
Check size argument to memwipe() for underflow.

Closes bug #18089. Reported by "gk", patch by "teor".
Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352),
commit 49dd5ef3 on 7 Nov 2012.
 2017-02-07 08:33:39 -05:00
John Brooks 053e11f397 Fix out-of-bounds read in INTRODUCE2 client auth 
The length of auth_data from an INTRODUCE2 cell is checked when the
auth_type is recognized (1 or 2), but not for any other non-zero
auth_type. Later, auth_data is assumed to have at least
REND_DESC_COOKIE_LEN bytes, leading to a client-triggered out of bounds
read.

Fixed by checking auth_len before comparing the descriptor cookie
against known clients.

Fixes #15823; bugfix on 0.2.1.6-alpha.
 2017-02-07 08:31:37 -05:00
Nick Mathewson e89163845a Merge branch 'maint-0.2.5' into release-0.2.5 2017-01-11 09:12:06 -05:00
Nick Mathewson 34fdd510ef Merge branch 'maint-0.2.4' into maint-0.2.5 2017-01-11 09:11:58 -05:00
Karsten Loesing 3833f67dd2 Update geoip and geoip6 to the January 4 2017 database. 2017-01-04 10:19:52 +01:00
Nick Mathewson 056978c31c Merge branch 'maint-0.2.5' into release-0.2.5 2016-12-20 18:11:16 -05:00
Nick Mathewson db58d4d16f Merge branch 'maint-0.2.4' into maint-0.2.5 2016-12-20 18:11:08 -05:00
Nick Mathewson d978216dea Fix parsing bug with unecognized token at EOS 
In get_token(), we could read one byte past the end of the
region. This is only a big problem in the case where the region
itself is (a) potentially hostile, and (b) not explicitly
nul-terminated.

This patch fixes the underlying bug, and also makes sure that the
one remaining case of not-NUL-terminated potentially hostile data
gets NUL-terminated.

Fix for bug 21018, TROVE-2016-12-002, and CVE-2016-1254
 2016-12-18 20:17:24 -05:00
Nick Mathewson 5322713b48 Merge branch 'maint-0.2.5' into release-0.2.5 2016-12-09 08:34:45 -05:00
Nick Mathewson 3d2d3f2b62 Merge branch 'maint-0.2.4' into maint-0.2.5 2016-12-09 08:33:57 -05:00
Karsten Loesing 9db47e7921 Update geoip and geoip6 to the December 7 2016 database. 2016-12-09 10:23:36 +01:00
Nick Mathewson 1ffe29ff8d Merge branch 'maint-0.2.5' into release-0.2.5 2016-11-07 09:30:05 -05:00
Nick Mathewson db2571be61 Merge branch 'maint-0.2.4' into maint-0.2.5 2016-11-07 09:29:54 -05:00