summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNick Mathewson <nickm@torproject.org>2007-05-10 19:29:32 +0000
committerNick Mathewson <nickm@torproject.org>2007-05-10 19:29:32 +0000
commit49b86388017ba7ad527e0e8340187a0b795449ac (patch)
tree9581b3a281a379b5caedfbe67882ecf39afcd83f
parentf294708f7f2cdd0f5635e40291691322b8569083 (diff)
downloadtor-49b86388017ba7ad527e0e8340187a0b795449ac.tar.gz
tor-49b86388017ba7ad527e0e8340187a0b795449ac.zip
r12718@catbus: nickm | 2007-05-10 15:24:05 -0400
Backport 10052+10053: avoid rare memory corruption on dirserver. svn:r10159
-rw-r--r--ChangeLog4
-rw-r--r--src/or/dirserv.c1
-rw-r--r--src/or/routerlist.c2
3 files changed, 6 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog
index d15d2789c7..d744119b97 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,10 @@ Changes in version 0.1.2.14 - 2007-0?-??
but leave it attached to the circuit, leading to unpredictable
behavior. (Reported by seeess, fixes bug 425.)
+ o Major bugfixes:
+ - Fix a bug in dirserv_remove_invalid() that would cause authorities to
+ corrupt memory under some really unlikely scenarios.
+
Changes in version 0.1.2.13 - 2007-04-24
o Minor fixes:
diff --git a/src/or/dirserv.c b/src/or/dirserv.c
index 9186f7252a..ff7f7cdbff 100644
--- a/src/or/dirserv.c
+++ b/src/or/dirserv.c
@@ -610,6 +610,7 @@ directory_remove_invalid(void)
ent->nickname, msg?msg:"");
routerlist_remove(rl, ent, i--, 0);
changed = 1;
+ continue;
}
if (bool_neq((r & FP_NAMED), ent->is_named)) {
log_info(LD_DIRSERV,
diff --git a/src/or/routerlist.c b/src/or/routerlist.c
index 0e496e3d78..92577f074d 100644
--- a/src/or/routerlist.c
+++ b/src/or/routerlist.c
@@ -4482,7 +4482,7 @@ routerlist_assert_ok(routerlist_t *rl)
digestmap_iter_t *iter;
routerinfo_t *r2;
signed_descriptor_t *sd2;
- if (!routerlist)
+ if (!rl)
return;
SMARTLIST_FOREACH(rl->routers, routerinfo_t *, r,
{