diff options
| author | Nick Mathewson <nickm@torproject.org> | 2015-10-21 10:00:52 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2015-10-21 10:00:52 -0400 |
| commit | 46cd466decfcf05cc7588256aa7e9491a7c9e918 (patch) | |
| tree | 77f2d6f0fecab362759588678d20e83c3b543847 | |
| parent | 34b4da709d04a64e52f023f7fa54fdbab270546f (diff) | |
| parent | 5b2070198a9fa7d19f50ba165dc6ff274ffe073a (diff) | |
| download | tor-46cd466decfcf05cc7588256aa7e9491a7c9e918.tar.gz tor-46cd466decfcf05cc7588256aa7e9491a7c9e918.zip | |
Merge remote-tracking branch 'origin/maint-0.2.7'
| -rw-r--r-- | changes/bug17401 | 3 | ||||
| -rw-r--r-- | src/or/rendcache.c | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/changes/bug17401 b/changes/bug17401 new file mode 100644 index 0000000000..a22f79c431 --- /dev/null +++ b/changes/bug17401 @@ -0,0 +1,3 @@ + o Major bugfixes (correctness): + - Fix a use-after-free bug in validate_intro_point_failure(). + Fixes bug 17401; bugfix on 0.2.7.3-rc. diff --git a/src/or/rendcache.c b/src/or/rendcache.c index a75028e7f7..e377e9ad81 100644 --- a/src/or/rendcache.c +++ b/src/or/rendcache.c @@ -418,8 +418,8 @@ validate_intro_point_failure(const rend_service_descriptor_t *desc, SMARTLIST_DEL_CURRENT(desc->intro_nodes, intro); /* Keep it for our new entry. */ digestmap_set(new_entry->intro_failures, (char *) identity, ent_dup); + /* Only free it when we're done looking at it. */ rend_intro_point_free(intro); - continue; } } SMARTLIST_FOREACH_END(intro); |