diff options
| author | Roger Dingledine <arma@torproject.org> | 2017-05-24 23:23:12 -0400 |
|---|---|---|
| committer | Roger Dingledine <arma@torproject.org> | 2017-05-24 23:37:00 -0400 |
| commit | d22d565331c7f8e02abb7720afd447c6b8760f21 (patch) | |
| tree | 803b5e6f826d3cbe092851833b1943d16124e27f | |
| parent | a7e75ff7966d7d3d83d41a47c5b9fa5e3daa2465 (diff) | |
| download | tor-d22d565331c7f8e02abb7720afd447c6b8760f21.tar.gz tor-d22d565331c7f8e02abb7720afd447c6b8760f21.zip | |
add copy of MyFamily element to the descriptor, not the element itself
If we add the element itself, we will later free it when we free the
descriptor, and the next time we go to look at MyFamily, things will
go badly.
Fixes the rest of bug 22368; bugfix on 0.3.1.1-alpha.
| -rw-r--r-- | changes/bug22368 | 6 | ||||
| -rw-r--r-- | src/or/router.c | 2 |
2 files changed, 7 insertions, 1 deletions
diff --git a/changes/bug22368 b/changes/bug22368 new file mode 100644 index 0000000000..eb445d0e43 --- /dev/null +++ b/changes/bug22368 @@ -0,0 +1,6 @@ + o Major bugfixes: + - Relays that set MyFamily no longer free the elements of + options->MyFamily while making their descriptor. They tried to + access the freed elements, and then double-free them, when making + the next descriptor or when changing the config. Fixes bug 22368; + bugfix on 0.3.1.1-alpha. diff --git a/src/or/router.c b/src/or/router.c index b43742aa83..f2741b70af 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -2308,7 +2308,7 @@ router_build_fresh_descriptor(routerinfo_t **r, extrainfo_t **e) smartlist_add_strdup(warned_nonexistent_family, name); } if (is_legal) { - smartlist_add(ri->declared_family, name); + smartlist_add_strdup(ri->declared_family, name); name = NULL; } } else if (router_digest_is_me(member->identity)) { |