summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNick Mathewson <nickm@torproject.org>2017-10-23 08:53:25 -0400
committerNick Mathewson <nickm@torproject.org>2017-10-23 08:53:25 -0400
commit74e8fd22c9971a7184d74d2775ca1c575e54e08f (patch)
treedd6eaa41902672df1d0804497aeadfa2dbb64f40
parent35574d4a9ad1ce0fb40d3c06493276a71990ac48 (diff)
parent132e2f69b1068b139d3c114fddd6efe58d6fc8f4 (diff)
downloadtor-74e8fd22c9971a7184d74d2775ca1c575e54e08f.tar.gz
tor-74e8fd22c9971a7184d74d2775ca1c575e54e08f.zip
Merge branch 'maint-0.2.9' into maint-0.3.0
-rw-r--r--changes/bug236905
-rw-r--r--src/or/circuitlist.c1
2 files changed, 6 insertions, 0 deletions
diff --git a/changes/bug23690 b/changes/bug23690
new file mode 100644
index 0000000000..36ff32e499
--- /dev/null
+++ b/changes/bug23690
@@ -0,0 +1,5 @@
+ o Major bugfixes (relay, crash, assertion failure):
+ - Fix a timing-based assertion failure that could occur when the
+ circuit out-of-memory handler freed a connection's output buffer.
+ Fixes bug 23690; bugfix on 0.2.6.1-alpha.
+
diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c
index 54a7db9dbf..8d6a4a7cc2 100644
--- a/src/or/circuitlist.c
+++ b/src/or/circuitlist.c
@@ -1986,6 +1986,7 @@ single_conn_free_bytes(connection_t *conn)
if (conn->outbuf) {
result += buf_allocation(conn->outbuf);
buf_clear(conn->outbuf);
+ conn->outbuf_flushlen = 0;
}
if (conn->type == CONN_TYPE_DIR) {
dir_connection_t *dir_conn = TO_DIR_CONN(conn);