[tor-commits] [tor/release-0.2.9] Fix a crash when a connection tries to open just after it has been unlinked

[nickm@xxxxxxxxxxxxxx]

commit 4b5cdb2c3060eefcc616764845a4ed7c002117b7
Author: teor <teor2345@xxxxxxxxx>
Date:   Thu Mar 2 09:49:35 2017 +1100

    Fix a crash when a connection tries to open just after it has been unlinked
    
    Fixes bug 21576; bugfix on Tor 0.2.9.3-alpha.
    Reported by alecmuffett.
---
 changes/bug21576         |  4 ++++
 src/or/connection_edge.c | 12 +++++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/changes/bug21576 b/changes/bug21576
new file mode 100644
index 0000000..68d8471
--- /dev/null
+++ b/changes/bug21576
@@ -0,0 +1,4 @@
+  o Major bugfixes (crash, directory connections):
+    - Fix a rare crash when sending a begin cell on a circuit whose linked
+      directory connection has already been closed. Fixes bug 21576;
+      bugfix on Tor 0.2.9.3-alpha. Reported by alecmuffett.
diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c
index 3550d0e..f033d17 100644
--- a/src/or/connection_edge.c
+++ b/src/or/connection_edge.c
@@ -2437,10 +2437,16 @@ connection_ap_handshake_send_begin(entry_connection_t *ap_conn)
   } else if (begin_type == RELAY_COMMAND_BEGIN_DIR) {
     /* This connection is a begindir directory connection.
      * Look at the linked directory connection to access the directory purpose.
-     * (This must be non-NULL, because we're doing begindir.) */
-    tor_assert(base_conn->linked);
+     * If a BEGINDIR connection is ever not linked, that's a bug. */
+    if (BUG(!base_conn->linked)) {
+      return -1;
+    }
     connection_t *linked_dir_conn_base = base_conn->linked_conn;
-    tor_assert(linked_dir_conn_base);
+    /* If the linked connection has been unlinked by other code, we can't send
+     * a begin cell on it. */
+    if (!linked_dir_conn_base) {
+      return -1;
+    }
     /* Sensitive directory connections must have an anonymous path length.
      * Otherwise, directory connections are typically one-hop.
      * This matches the earlier check for directory connection path anonymity



_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits