two more rare race conditions

svn:r143

2 files changed, 10 insertions, 6 deletions

diff --git a/src/or/circuit.c b/src/or/circuit.c
index 4c11037841..88de5c82e6 100644
--- a/src/or/circuit.c
+++ b/src/or/circuit.c
@@ -359,9 +359,11 @@ void circuit_about_to_close_connection(connection_t *conn) {
   while((circ = circuit_get_by_conn(conn))) {
     circuit_remove(circ);
     if(circ->n_conn == conn) /* it's closing in front of us */
+      /* circ->p_conn should always be set */
       connection_send_destroy(circ->p_aci, circ->p_conn);
     if(circ->p_conn == conn) /* it's closing behind us */
-      connection_send_destroy(circ->n_aci, circ->n_conn);
+      if(circ->n_conn)
+        connection_send_destroy(circ->n_aci, circ->n_conn);
     circuit_free(circ);
   }  
 }
diff --git a/src/or/onion.c b/src/or/onion.c
index 36141c8d1b..083e60e8c3 100644
--- a/src/or/onion.c
+++ b/src/or/onion.c
@@ -87,23 +87,25 @@ int onion_pending_check(void) {
 
 void onion_pending_process_one(void) {
   struct data_queue_t *tmpd;
+  circuit_t *circ; 
 
   if(!ol_list)
     return; /* no onions pending, we're done */
 
   assert(ol_list->circ && ol_list->circ->p_conn);
   assert(ol_length > 0);
+  circ = ol_list->circ;
 
-  if(onion_process(ol_list->circ) < 0) {
+  if(onion_process(circ) < 0) {
     log(LOG_DEBUG,"onion_pending_process_one(): Failed. Closing.");
-    onion_pending_remove(ol_list->circ);
-    circuit_close(ol_list->circ);
+    onion_pending_remove(circ);
+    circuit_close(circ);
   } else {
     log(LOG_DEBUG,"onion_pending_process_one(): Succeeded. Delivering queued data cells.");
     for(tmpd = ol_list->data_cells; tmpd; tmpd=tmpd->next) {
-      command_process_data_cell(tmpd->cell, ol_list->circ->p_conn); 
+      command_process_data_cell(tmpd->cell, circ->p_conn); 
     }
-    onion_pending_remove(ol_list->circ);
+    onion_pending_remove(circ);
   }
   return;
 }