nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-09-20 21:16:22 +02:00
Code Issues Packages Projects Releases Wiki Activity
561d9880f8
tor/changes/bug10409

4 lines
153 B
Plaintext
Raw Normal View History

Avoid free()ing from an mmap on corrupted microdesc cache The 'body' field of a microdesc_t holds a strdup()'d value if the microdesc's saved_location field is SAVED_IN_JOURNAL or SAVED_NOWHERE, and holds a pointer to the middle of an mmap if the microdesc is SAVED_IN_CACHE. But we weren't setting that field until a while after we parsed the microdescriptor, which left an interval where microdesc_free() would try to free() the middle of the mmap(). This patch also includes a regression test. This is a fix for #10409; bugfix on 0.2.2.6-alpha.
2013-12-16 19:00:15 +01:00
o Minor bugfixes:
- Avoid a crash bug when starting with a corrupted microdescriptor
cache file. Fix for bug 10406; bugfix on 0.2.2.6-alpha.
Reference in New Issue Copy Permalink