Patch from lark: if we get two extend cells for the same circuit id, drop the second. Previously, we had leaked an extend_info if the target connection was not open when the second arrived.

svn:r18668

2 files changed, 7 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index 31a87219b3..fa2037c4cd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -30,6 +30,8 @@ Changes in version 0.2.1.13-????? - 2009-02-??
       seconds. Bugfix on 0.1.2.7-alpha; reported by Mike Perry.
     - Drop begin cells to a hidden service if they come from the middle of a
       circuit.  Patch from lark.
+    - When we erroneously receive two EXTEND cells for the same circuit ID
+      on the same connection, drop the second.  Patch from lark.
 
   o Minor features:
     - On Linux, use the prctl call to re-enable core dumps when the user
diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c
index 12db9dd7c5..42da9e6fe0 100644
--- a/src/or/circuitbuild.c
+++ b/src/or/circuitbuild.c
@@ -735,6 +735,11 @@ circuit_extend(cell_t *cell, circuit_t *circ)
            "n_conn already set. Bug/attack. Closing.");
     return -1;
   }
+  if (circ->n_hop) {
+    log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
+           "conn to next hop already launched. Bug/attack. Closing.");
+    return -1;
+  }
 
   if (!server_mode(get_options())) {
     log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,