diff options
author | Alexander Færøy <ahf@torproject.org> | 2019-02-26 15:26:33 +0100 |
---|---|---|
committer | Alexander Færøy <ahf@torproject.org> | 2019-02-26 15:43:09 +0100 |
commit | aa360b255bc1c262486500655bac70c4f0f00118 (patch) | |
tree | 8ef0c62652023d6f9396aac9a4b9f4944330da50 /changes/bug29298 | |
parent | 1bff5646e64a32b83dcf5ac5acf4e31b98382aae (diff) | |
download | tor-aa360b255bc1c262486500655bac70c4f0f00118.tar.gz tor-aa360b255bc1c262486500655bac70c4f0f00118.zip |
Fix crash bug in PT subsystem.
This patch fixes a crash bug (assertion failure) in the PT subsystem
that could get triggered if the user cancels bootstrap via the UI in
TorBrowser. This would cause Tor to call `managed_proxy_destroy()` which
called `process_free()` after it had called `process_terminate()`. This
leads to a crash when the various process callbacks returns with data
after the `process_t` have been freed using `process_free()`.
We solve this issue by ensuring that everywhere we call
`process_terminate()` we make sure to detach the `managed_proxy_t` from
the `process_t` (by calling `process_set_data(process, NULL)`) and avoid
calling `process_free()` at all in the transports code. Instead we just
call `process_terminate()` and let the process exit callback in
`managed_proxy_exit_callback()` handle the `process_free()` call by
returning true to the process subsystem.
See: https://bugs.torproject.org/29562
Diffstat (limited to 'changes/bug29298')
0 files changed, 0 insertions, 0 deletions