r12317@catbus: nickm | 2007-04-09 15:50:51 -0400

 Fix second part of bug 411 (which was actually a separate bug): it isnt safe to clear a cell queue while the circuit is active.


svn:r9928

1 files changed, 8 insertions, 4 deletions

diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c
index d9da7a9728..a0aa27c7d1 100644
--- a/src/or/circuitlist.c
+++ b/src/or/circuitlist.c
@@ -398,19 +398,23 @@ circuit_free(circuit_t *circ)
       other->rend_splice = NULL;
     }
 
-    cell_queue_clear(&ocirc->p_conn_cells);
-
     tor_free(circ->onionskin);
 
     /* remove from map. */
     circuit_set_p_circid_orconn(ocirc, 0, NULL);
-  }
 
-  cell_queue_clear(&circ->n_conn_cells);
+    /* Clear cell queue _after_ removing it from the map.  Otherwise our
+     * "active" checks will be violated. */
+    cell_queue_clear(&ocirc->p_conn_cells);
+  }
 
   /* Remove from map. */
   circuit_set_n_circid_orconn(circ, 0, NULL);
 
+  /* Clear cell queue _after_ removing it from the map.  Otherwise our
+   * "active" checks will be violated. */
+  cell_queue_clear(&circ->n_conn_cells);
+
   memset(circ, 0xAA, sizeof(circuit_t)); /* poison memory */
   tor_free(mem);
 }