Fix a segfault caused by a weird logic error and masked by another.

svn:r820

2 files changed, 8 insertions, 4 deletions

diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c
index d20f1d4059..4f1bdafa1b 100644
--- a/src/or/connection_edge.c
+++ b/src/or/connection_edge.c
@@ -772,6 +772,10 @@ int connection_ap_can_use_exit(connection_t *conn, routerinfo_t *exit)
 {
   uint32_t addr;
 
+  assert(conn);
+  assert(conn->type == CONN_TYPE_AP);
+  assert(conn->socks_request);
+
   addr = client_dns_lookup_entry(conn->socks_request->address);
   return router_supports_exit_address(addr, conn->port, exit);
 }
diff --git a/src/or/onion.c b/src/or/onion.c
index 5ef2023d60..dec1f2b9a5 100644
--- a/src/or/onion.c
+++ b/src/or/onion.c
@@ -245,10 +245,10 @@ static routerinfo_t *choose_good_exit_server(directory_t *dir)
   n_maybe_supported = tor_malloc(sizeof(int)*dir->n_routers);
   for (i = 0; i < dir->n_routers; ++i) {
     n_supported[i] = n_maybe_supported[i] = 0;
-    for (j = 0; j < n_pending_connections; ++j) {
-      if (carray[i]->type != CONN_TYPE_AP || 
-          carray[i]->state == AP_CONN_STATE_CIRCUIT_WAIT ||
-          carray[i]->marked_for_close)
+    for (j = 0; j < n_connections; ++j) {
+      if (carray[j]->type != CONN_TYPE_AP || 
+          carray[j]->state == AP_CONN_STATE_CIRCUIT_WAIT ||
+          carray[j]->marked_for_close)
         continue;
       switch (connection_ap_can_use_exit(carray[j], dir->routers[i])) 
         {