]> git.ipfire.org Git - thirdparty/tor.git/commitdiff
Fix a signed integer overflow in dir/download_status_random_backoff
authorNick Mathewson <nickm@torproject.org>
Fri, 14 Jul 2017 17:56:40 +0000 (13:56 -0400)
committerNick Mathewson <nickm@torproject.org>
Fri, 14 Jul 2017 19:05:30 +0000 (15:05 -0400)
Fix for 22924. Bugfix on 0.2.9.1-alpha when the test was introducd
-- though it couldn't actually overflow until we fixed 17750.

Additionally, this only seems to overflow on 32-bit, and only when
the compiler doesn't re-order the (possibly dead) assignment out of
the way.  We ran into it on a 32-bit ubuntu trusty builder.

changes/bug22924 [new file with mode: 0644]
src/test/test_dir.c

diff --git a/changes/bug22924 b/changes/bug22924
new file mode 100644 (file)
index 0000000..e59fc72
--- /dev/null
@@ -0,0 +1,4 @@
+  o Minor bugfies (tests):
+    - Fix a signed-integer overflow in the unit tests for
+      dir/download_status_random_backoff, which was untriggered until we
+      fixed bug 17750.  Fixes bug 22924; bugfix on 0.2.9.1-alpha.
index 53911e8a26531c83a0c913485d05f1f3d14a0b5a..729ae643b527da9b4512beba65e7873d136845ea 100644 (file)
@@ -3657,12 +3657,14 @@ download_status_random_backoff_helper(int min_delay, int max_delay)
     }
 
     /* Advance */
-    current_time += increment;
     ++(dls_random.n_download_attempts);
     ++(dls_random.n_download_failures);
 
     /* Try another maybe */
     old_increment = increment;
+    if (increment >= max_delay)
+      current_time += increment;
+
   } while (increment < max_delay);
 
  done: