diff options
| -rw-r--r-- | changes/bug5541 | 8 | ||||
| -rw-r--r-- | src/or/relay.c | 8 |
2 files changed, 14 insertions, 2 deletions
diff --git a/changes/bug5541 b/changes/bug5541 new file mode 100644 index 0000000000..3cf0692e9f --- /dev/null +++ b/changes/bug5541 @@ -0,0 +1,8 @@ + o Minor bugfixes: + - Prevent a null-pointer dereference when receiving a data cell + for a nonexistent stream when the circuit in question has an + empty deliver window. We don't believe this is triggerable, + since we don't currently allow deliver windows to become empty, + but the logic is tricky enough that it's better to make the code + robust. Fixes bug 5541; bugfix on 0.0.2pre14. + diff --git a/src/or/relay.c b/src/or/relay.c index b637fadf59..3c2c81b82b 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1103,8 +1103,12 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, (!layer_hint && --circ->deliver_window < 0)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "(relay data) circ deliver_window below 0. Killing."); - connection_edge_end(conn, END_STREAM_REASON_TORPROTOCOL); - connection_mark_for_close(TO_CONN(conn)); + if (conn) { + /* XXXX Do we actually need to do this? Will killing the circuit + * not send an END and mark the stream for close as appropriate? */ + connection_edge_end(conn, END_STREAM_REASON_TORPROTOCOL); + connection_mark_for_close(TO_CONN(conn)); + } return -END_CIRC_REASON_TORPROTOCOL; } log_debug(domain,"circ deliver_window now %d.", layer_hint ? |