[tor-commits] [tor/maint-0.2.4] Handle TRUNCATE correctly if our next channel isn't done yet.

[nickm@xxxxxxxxxxxxxx]

commit bd9901bef245b3880c9a60034b9fdf6d4829eb65
Author: Nick Mathewson <nickm@xxxxxxxxxxxxxx>
Date:   Mon Mar 18 15:55:55 2013 -0400

    Handle TRUNCATE correctly if our next channel isn't done yet.
    
    Patch from 'cypherpunks'. Fixes bug #7947. Bugfix on 0.0.7.1.
---
 changes/bug7947 |    4 ++++
 src/or/relay.c  |    8 ++++++++
 2 files changed, 12 insertions(+), 0 deletions(-)

diff --git a/changes/bug7947 b/changes/bug7947
new file mode 100644
index 0000000..6200ba2
--- /dev/null
+++ b/changes/bug7947
@@ -0,0 +1,4 @@
+  o Minor bugfixes:
+    - Fix the handling of a TRUNCATE cell when it arrives while the circuit
+      extension is in progress. Fixes bug 7947; bugfix on 0.0.7.1.
+
diff --git a/src/or/relay.c b/src/or/relay.c
index 9ff9e1e..8e80d14 100644
--- a/src/or/relay.c
+++ b/src/or/relay.c
@@ -1398,6 +1398,14 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ,
                "'truncate' unsupported at origin. Dropping.");
         return 0;
       }
+      if (circ->n_hop) {
+        if (circ->n_chan)
+          log_warn(LD_BUG, "n_chan and n_hop set on the same circuit!");
+        extend_info_free(circ->n_hop);
+        circ->n_hop = NULL;
+        tor_free(circ->n_chan_create_cell);
+        circuit_set_state(circ, CIRCUIT_STATE_OPEN);
+      }
       if (circ->n_chan) {
         uint8_t trunc_reason = get_uint8(cell->payload + RELAY_HEADER_SIZE);
         circuit_clear_cell_queue(circ, circ->n_chan);



_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits