forward-port the logic skew and double-free thing

svn:r3549

3 files changed, 10 insertions, 11 deletions

diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c
index ddb0c484b1..17b9cc41dd 100644
--- a/src/or/connection_edge.c
+++ b/src/or/connection_edge.c
@@ -866,12 +866,7 @@ int connection_exit_begin_conn(cell_t *cell, circuit_t *circ) {
       connection_exit_connect(n_stream);
       return 0;
     case -1: /* resolve failed */
-      log_fn(LOG_INFO,"Resolve failed (%s).", n_stream->address);
-      if (!n_stream->marked_for_close) {
-        connection_edge_end(n_stream, END_STREAM_REASON_RESOLVEFAILED,
-                            n_stream->cpath_layer);
-      }
-      connection_free(n_stream);
+      /* n_stream got freed. don't touch it. */
       break;
     case 0: /* resolve added to pending list */
       /* add it into the linked list of resolving_streams on this circuit */
@@ -916,8 +911,7 @@ int connection_exit_begin_resolve(cell_t *cell, circuit_t *circ) {
   switch (dns_resolve(dummy_conn)) {
     case 1: /* The result was cached; a resolved cell was sent. */
     case -1:
-      circuit_detach_stream(circuit_get_by_conn(dummy_conn), dummy_conn);
-      connection_free(dummy_conn);
+      /* dummy_conn got freed, don't touch it */
       return 0;
     case 0: /* resolve added to pending list */
       assert_circuit_ok(circ);
diff --git a/src/or/directory.c b/src/or/directory.c
index 1fd242a1be..98cf78a5d0 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -694,7 +694,7 @@ connection_dir_client_reached_eof(connection_t *conn)
       tor_free(body); tor_free(headers);
       return -1;
     }
-    if (router_load_routerlist_from_directory(body, NULL, skewed, 0) < 0) {
+    if (router_load_routerlist_from_directory(body, NULL, !skewed, 0) < 0) {
       log_fn(LOG_NOTICE,"I failed to parse the directory I fetched from %s:%d. Ignoring.", conn->address, conn->port);
     } else {
       log_fn(LOG_INFO,"updated routers.");
diff --git a/src/or/dns.c b/src/or/dns.c
index 3e862ce692..5e68c63f9d 100644
--- a/src/or/dns.c
+++ b/src/or/dns.c
@@ -194,7 +194,7 @@ insert_resolve(struct cached_resolve *r)
 
 /** See if we have a cache entry for <b>exitconn</b>-\>address. if so,
  * if resolve valid, put it into <b>exitconn</b>-\>addr and return 1.
- * If resolve failed, return -1.
+ * If resolve failed, unlink exitconn if needed, free it, and return -1.
  *
  * Else, if seen before and pending, add conn to the pending list,
  * and return 0.
@@ -207,6 +207,7 @@ int dns_resolve(connection_t *exitconn) {
   struct cached_resolve search;
   struct pending_connection_t *pending_connection;
   struct in_addr in;
+  circuit_t *circ;
   uint32_t now = time(NULL);
   assert_connection_ok(exitconn, 0);
   tor_assert(exitconn->s == -1);
@@ -250,6 +251,10 @@ int dns_resolve(connection_t *exitconn) {
                exitconn->s, exitconn->address);
         if (exitconn->purpose == EXIT_PURPOSE_RESOLVE)
           send_resolved_cell(exitconn, RESOLVED_TYPE_ERROR);
+        circ = circuit_get_by_conn(exitconn);
+        if (circ)
+          circuit_detach_stream(circ, exitconn);
+        connection_free(exitconn);
         return -1;
     }
     tor_assert(0);
@@ -288,7 +293,7 @@ static int assign_to_dnsworker(connection_t *exitconn) {
     log_fn(LOG_WARN,"no idle dns workers. Failing.");
     if (exitconn->purpose == EXIT_PURPOSE_RESOLVE)
       send_resolved_cell(exitconn, RESOLVED_TYPE_ERROR_TRANSIENT);
-    dns_cancel_pending_resolve(exitconn->address); /* also sends end */
+    dns_cancel_pending_resolve(exitconn->address); /* also sends end and frees! */
     return -1;
   }