From: Nick Mathewson <nickm@torproject.org>
Date: Wed, 20 Jun 2018 20:11:09 +0000 (-0400)
Subject: Don't use any asserts(), even raw, in format_number_sigsafe().
X-Git-Tag: tor-0.3.5.1-alpha~396
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c86850c4c9e8154fdd6e0be53f455a573df17155;p=thirdparty%2Ftor.git

Don't use any asserts(), even raw, in format_number_sigsafe().

Also explain why.
---

diff --git a/src/common/torerr.c b/src/common/torerr.c
index 5dbdc629ad..0e0c4db355 100644
--- a/src/common/torerr.c
+++ b/src/common/torerr.c
@@ -155,8 +155,9 @@ format_number_sigsafe(unsigned long x, char *buf, int buf_len,
   int len;
   char *cp;
 
-  /* NOT tor_assert. This needs to be safe to run from within a signal handler,
-   * and from within the 'tor_assert() has failed' code. */
+  /* NOT tor_assert. This needs to be safe to run from within a signal
+   * handler, and from within the 'tor_assert() has failed' code.  Not even
+   * raw_assert(), since raw_assert() calls this function on failure. */
   if (radix < 2 || radix > 16)
     return 0;
 
@@ -176,7 +177,10 @@ format_number_sigsafe(unsigned long x, char *buf, int buf_len,
   *cp = '\0';
   do {
     unsigned digit = (unsigned) (x % radix);
-    raw_assert(cp > buf);
+    if (cp <= buf) {
+      /* Not tor_assert(); see above. */
+      abort();
+    }
     --cp;
     *cp = "0123456789ABCDEF"[digit];
     x /= radix;