diff options
| author | teor <teor2345@gmail.com> | 2017-03-02 09:49:35 +1100 |
|---|---|---|
| committer | teor <teor2345@gmail.com> | 2017-03-02 11:10:30 +1100 |
| commit | 4b5cdb2c3060eefcc616764845a4ed7c002117b7 (patch) | |
| tree | e39ea4d03e2569e3d7d4bb91d64284f0c3a71976 | |
| parent | 75492598b2fa595c25c41212d3b2714e59efdcc2 (diff) | |
| download | tor-4b5cdb2c3060eefcc616764845a4ed7c002117b7.tar.gz tor-4b5cdb2c3060eefcc616764845a4ed7c002117b7.zip | |
Fix a crash when a connection tries to open just after it has been unlinked
Fixes bug 21576; bugfix on Tor 0.2.9.3-alpha.
Reported by alecmuffett.
| -rw-r--r-- | changes/bug21576 | 4 | ||||
| -rw-r--r-- | src/or/connection_edge.c | 12 |
2 files changed, 13 insertions, 3 deletions
diff --git a/changes/bug21576 b/changes/bug21576 new file mode 100644 index 0000000000..68d8471192 --- /dev/null +++ b/changes/bug21576 @@ -0,0 +1,4 @@ + o Major bugfixes (crash, directory connections): + - Fix a rare crash when sending a begin cell on a circuit whose linked + directory connection has already been closed. Fixes bug 21576; + bugfix on Tor 0.2.9.3-alpha. Reported by alecmuffett. diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 3550d0e212..f033d17adb 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -2437,10 +2437,16 @@ connection_ap_handshake_send_begin(entry_connection_t *ap_conn) } else if (begin_type == RELAY_COMMAND_BEGIN_DIR) { /* This connection is a begindir directory connection. * Look at the linked directory connection to access the directory purpose. - * (This must be non-NULL, because we're doing begindir.) */ - tor_assert(base_conn->linked); + * If a BEGINDIR connection is ever not linked, that's a bug. */ + if (BUG(!base_conn->linked)) { + return -1; + } connection_t *linked_dir_conn_base = base_conn->linked_conn; - tor_assert(linked_dir_conn_base); + /* If the linked connection has been unlinked by other code, we can't send + * a begin cell on it. */ + if (!linked_dir_conn_base) { + return -1; + } /* Sensitive directory connections must have an anonymous path length. * Otherwise, directory connections are typically one-hop. * This matches the earlier check for directory connection path anonymity |