diff options
| author | Nick Mathewson <nickm@torproject.org> | 2018-09-14 10:34:45 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2018-09-14 10:34:45 -0400 |
| commit | 281854bab7001cc838c91b521b41b666140e124f (patch) | |
| tree | 500432c30640deef23bbc3e06cbb44c88504d18b | |
| parent | 7c26f88fd7bde6844f36f4810675688542c313bf (diff) | |
| download | tor-281854bab7001cc838c91b521b41b666140e124f.tar.gz tor-281854bab7001cc838c91b521b41b666140e124f.zip | |
If options_act() fails, restore the previous value of global_options
Before 0.3.3.1-alpha, we would exit() in this case immediately. But
now that we leave tor_main() more conventionally, we need to make
sure we restore things so as not to cause a double free.
Fixes bug 27708; bugfix on 0.3.3.1-alpha.
| -rw-r--r-- | changes/bug27708 | 4 | ||||
| -rw-r--r-- | src/or/config.c | 1 |
2 files changed, 5 insertions, 0 deletions
diff --git a/changes/bug27708 b/changes/bug27708 new file mode 100644 index 0000000000..d283b19515 --- /dev/null +++ b/changes/bug27708 @@ -0,0 +1,4 @@ + o Major bugfixes (restart-in-process): + - Fix a use-after-free error that could be caused by passing Tor an + impossible set of options that would fail during options_act(). + Fixes bug 27708; bugfix on 0.3.3.1-alpha. diff --git a/src/or/config.c b/src/or/config.c index ac37324a2a..58080c65e3 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -868,6 +868,7 @@ set_options(or_options_t *new_val, char **msg) "Acting on config options left us in a broken state. Dying."); tor_shutdown_event_loop_and_exit(1); } + global_options = old_options; return -1; } /* Issues a CONF_CHANGED event to notify controller of the change. If Tor is |