From 419f541aa737d3ab230ec2595d0614e2d94a5e44 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Fri, 6 Jul 2012 07:29:54 -0400 Subject: Fix a bug handling SENDME cells on nonexistent streams. This could result in bizarre window values. Report and patch contributed pseudymously. Fixes part of bug 6271. This bug was introduced before the first Tor release, in svn commit r152. (bug 6271, part a.) --- src/or/relay.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'src/or') diff --git a/src/or/relay.c b/src/or/relay.c index b637fadf59..50c14556ff 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1220,7 +1220,7 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "'connected' received, no conn attached anymore. Ignoring."); return 0; case RELAY_COMMAND_SENDME: - if (!conn) { + if (!rh.stream_id) { if (layer_hint) { layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", @@ -1235,6 +1235,11 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, } return 0; } + if (!conn) { + log_info(domain,"sendme cell dropped, unknown stream (streamid %d).", + rh.stream_id); + return 0; + } conn->package_window += STREAMWINDOW_INCREMENT; log_debug(domain,"stream-level sendme, packagewindow now %d.", conn->package_window); -- cgit v1.2.3-54-g00ecf