assert() crasher in circuitlist.c:414

["Joe Magic" <magicjoe@mail333.com>]

Hello dear developers and users,

lately we where able to reproduce a crasher bug on a
windows xp system. as that happened a few times we
truned on the debug-mode before.

[notice] Tor 0.0.9pre2 opening new log file.
...
[warn] Stream is 15 secondslate. Retrying.
[warn] circ (length: 3, exit random): solid(open)
err(open) random(open)
[warn] No Tor server exists that allows exit to
xxx.xxx.xxx.xxx:4662. Rejecting. (please note that I
replaced the ip-address with xxx)
[err] D:\\Documents and Settings\\someone\\My
Documents\\tor\\src\\or\\circuitlist.c:414: ???: Assertion 
0 failed; aborting.

From looking over the code I note that line 414 in
circuitlist.c is inside the function
assert_cpath_layer_ok(const crypt_path_t *cp) and the
assert() occurs at the default-statement of
switch(cp->state)
{
    case CPATH_STATE_OPEN:
      ...
    case CPATH_STATE_CLOSED:
      ...
    case CPATH_STATE_AWAITING_KEYS:
      ...
    default:
      tor_assert(0);
}

It seems assert_cpath_layer_ok() got called just a hand
full of times in the source. Looking over them showed
the using of it in circuitlist.c at line 429 in the
function assert_cpath_ok(const crypt_path_t *cp).
The inline-comment /* layers must be in sequence of:
\"open* awaiting? closed*\" */ says it. cp->state could
be CPATH_STATE_AWAITING_KEYS (at least following lines
check for that), but assert_cpath_layer_ok() doesn\'t
allow that.

In hope this report helps and got readed by someone who
is somewhat deeper in the tor-code then me and is able
to fix it without breaking things.

your magicjoe