diff options
| author | Nick Mathewson <nickm@torproject.org> | 2012-05-31 12:40:30 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2012-05-31 12:40:30 -0400 |
| commit | fc5d960fbda217a301b4ec09d906992b74849c15 (patch) | |
| tree | d0b8f5afee7f4a7ff2417c3b22ab27b4d81d5ca6 | |
| parent | 0e207f9acb655d037c8aef86ea2781d8e1b4b570 (diff) | |
| parent | edf0d5b12c5d51e9f82e9c215d3b0386cf4688db (diff) | |
| download | tor-fc5d960fbda217a301b4ec09d906992b74849c15.tar.gz tor-fc5d960fbda217a301b4ec09d906992b74849c15.zip | |
Merge remote-tracking branch 'public/bug5541_v2'
| -rw-r--r-- | changes/bug5541 | 8 | ||||
| -rw-r--r-- | src/or/relay.c | 8 |
2 files changed, 14 insertions, 2 deletions
diff --git a/changes/bug5541 b/changes/bug5541 new file mode 100644 index 0000000000..3cf0692e9f --- /dev/null +++ b/changes/bug5541 @@ -0,0 +1,8 @@ + o Minor bugfixes: + - Prevent a null-pointer dereference when receiving a data cell + for a nonexistent stream when the circuit in question has an + empty deliver window. We don't believe this is triggerable, + since we don't currently allow deliver windows to become empty, + but the logic is tricky enough that it's better to make the code + robust. Fixes bug 5541; bugfix on 0.0.2pre14. + diff --git a/src/or/relay.c b/src/or/relay.c index 38a563fece..c540d969fc 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1125,8 +1125,12 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, (!layer_hint && --circ->deliver_window < 0)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "(relay data) circ deliver_window below 0. Killing."); - connection_edge_end(conn, END_STREAM_REASON_TORPROTOCOL); - connection_mark_for_close(TO_CONN(conn)); + if (conn) { + /* XXXX Do we actually need to do this? Will killing the circuit + * not send an END and mark the stream for close as appropriate? */ + connection_edge_end(conn, END_STREAM_REASON_TORPROTOCOL); + connection_mark_for_close(TO_CONN(conn)); + } return -END_CIRC_REASON_TORPROTOCOL; } log_debug(domain,"circ deliver_window now %d.", layer_hint ? |