diff options
| -rw-r--r-- | changes/bug7816.024 | 8 | ||||
| -rw-r--r-- | src/or/dirvote.c | 20 | ||||
| -rw-r--r-- | src/or/router.c | 1 |
3 files changed, 20 insertions, 9 deletions
diff --git a/changes/bug7816.024 b/changes/bug7816.024 new file mode 100644 index 0000000000..b5d55f5d6d --- /dev/null +++ b/changes/bug7816.024 @@ -0,0 +1,8 @@ + o Minor bugfixes: + - Avoid leaking IPv6 policy content if we fail to format it into + a router descriptor. Spotted by Coverity. Fixes part of 7816; + bugfix on 0.2.4.7-alpha. + + - Avoid leaking memory if we fail to compute a consensus signature + or we generated a consensus we couldn't parse. Spotted by Coverity. + Fixes part of 7816; bugfix on 0.2.0.5-alpha. diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 43b9f5eb12..469c86c7c5 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -2144,7 +2144,7 @@ networkstatus_compute_consensus(smartlist_t *votes, digest, digest_len, legacy_signing_key)) { log_warn(LD_BUG, "Couldn't sign consensus networkstatus."); - return NULL; /* This leaks, but it should never happen. */ + goto done; } smartlist_add(chunks, tor_strdup(sigbuf)); } @@ -2152,13 +2152,6 @@ networkstatus_compute_consensus(smartlist_t *votes, result = smartlist_join_strings(chunks, "", 0, NULL); - tor_free(client_versions); - tor_free(server_versions); - SMARTLIST_FOREACH(flags, char *, cp, tor_free(cp)); - smartlist_free(flags); - SMARTLIST_FOREACH(chunks, char *, cp, tor_free(cp)); - smartlist_free(chunks); - { networkstatus_t *c; if (!(c = networkstatus_parse_vote_from_string(result, NULL, @@ -2166,7 +2159,7 @@ networkstatus_compute_consensus(smartlist_t *votes, log_err(LD_BUG, "Generated a networkstatus consensus we couldn't " "parse."); tor_free(result); - return NULL; + goto done; } // Verify balancing parameters if (consensus_method >= MIN_METHOD_FOR_BW_WEIGHTS && added_weights) { @@ -2175,6 +2168,15 @@ networkstatus_compute_consensus(smartlist_t *votes, networkstatus_vote_free(c); } + done: + + tor_free(client_versions); + tor_free(server_versions); + SMARTLIST_FOREACH(flags, char *, cp, tor_free(cp)); + smartlist_free(flags); + SMARTLIST_FOREACH(chunks, char *, cp, tor_free(cp)); + smartlist_free(chunks); + return result; } diff --git a/src/or/router.c b/src/or/router.c index db396f0d56..b52632c581 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -2399,6 +2399,7 @@ router_dump_router_to_string(char *s, size_t maxlen, routerinfo_t *router, "ipv6-policy %s\n", p6); if (result<0) { log_warn(LD_BUG,"Descriptor printf of policy ran out of room"); + tor_free(p6); return -1; } written += result; |