diff options
| author | Nick Mathewson <nickm@torproject.org> | 2012-03-31 14:17:41 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2012-05-15 14:45:51 -0400 |
| commit | edf0d5b12c5d51e9f82e9c215d3b0386cf4688db (patch) | |
| tree | aed7481c43a15503d8728f1f9bbe175c493b0e46 /changes | |
| parent | 9740f067c4bed47beb63483be4f4636167a04019 (diff) | |
| download | tor-edf0d5b12c5d51e9f82e9c215d3b0386cf4688db.tar.gz tor-edf0d5b12c5d51e9f82e9c215d3b0386cf4688db.zip | |
Prevent an (impossible) null-pointer dereference in connection_edge_process_relay_cell
This would happen if the deliver window could become negative
because of an nonexistent connection. (Fortunately, _that_ can't
occur, thanks to circuit_consider_sending_sendme. Still, if we
change our windowing logic at all, we won't want this to become
triggerable.) Fix for bug 5541. Bugfix on 4a66865d, back from
0.0.2pre14. asn found this. Nice catch, asn!
Diffstat (limited to 'changes')
| -rw-r--r-- | changes/bug5541 | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/changes/bug5541 b/changes/bug5541 new file mode 100644 index 0000000000..3cf0692e9f --- /dev/null +++ b/changes/bug5541 @@ -0,0 +1,8 @@ + o Minor bugfixes: + - Prevent a null-pointer dereference when receiving a data cell + for a nonexistent stream when the circuit in question has an + empty deliver window. We don't believe this is triggerable, + since we don't currently allow deliver windows to become empty, + but the logic is tricky enough that it's better to make the code + robust. Fixes bug 5541; bugfix on 0.0.2pre14. + |