when the dns resolve is cancelled, or fails, be sure to remove

conn from circ->resolving_streams

otherwise it gets freed and stays there, causing seg faults.


svn:r1915

3 files changed, 5 insertions, 2 deletions

diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c
index 9cdfb809be..e87931f52e 100644
--- a/src/or/circuitlist.c
+++ b/src/or/circuitlist.c
@@ -200,7 +200,7 @@ circuit_t *circuit_get_by_circ_id_conn(uint16_t circ_id, connection_t *conn) {
 }
 
 /** Return a circ such that circ is attached to <b>conn</b>, either as
- * p_conn, n-conn, or in p_streams or n_streams.
+ * p_conn, n-conn, or in p_streams or n_streams or resolving_streams.
  *
  * Return NULL if no such circuit exists.
  */
diff --git a/src/or/connection.c b/src/or/connection.c
index e868a43bf9..90bcd83a3c 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -208,8 +208,10 @@ void connection_about_to_close_connection(connection_t *conn)
       }
       break;
     case CONN_TYPE_EXIT:
-      if (conn->state == EXIT_CONN_STATE_RESOLVING)
+      if (conn->state == EXIT_CONN_STATE_RESOLVING) {
+        circuit_detach_stream(circuit_get_by_conn(conn), conn);
         connection_dns_remove(conn);
+      }
       break;
     case CONN_TYPE_DNSWORKER:
       if (conn->state == DNSWORKER_STATE_BUSY) {
diff --git a/src/or/dns.c b/src/or/dns.c
index f00868d9f1..0106c4d814 100644
--- a/src/or/dns.c
+++ b/src/or/dns.c
@@ -436,6 +436,7 @@ static void dns_found_answer(char *address, uint32_t addr, char outcome) {
                                 connection_mark_for_close macro */
       /* prevent double-remove. */
       pendconn->state = EXIT_CONN_STATE_RESOLVEFAILED;
+      circuit_detach_stream(circuit_get_by_conn(pendconn), pendconn);
       connection_edge_end(pendconn, END_STREAM_REASON_MISC, pendconn->cpath_layer);
       connection_mark_for_close(pendconn);
       connection_free(pendconn);