nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-28 22:33:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

Clean up service-side descriptor cache and fix potential double-free.

Browse Source 
Entries in the service-side descriptor cache are now cleaned when
rend_cache_free_all() is called. The call to tor_free(intro_content)
in rend_cache_store_v2_desc_as_service() is moved to prevent a
potential double-free when a service has a descriptor with a newer
timestamp already in it's service-side descriptor cache.
This commit is contained in:
Donncha O'Cearbhaill 2015-08-03 17:37:09 +02:00
parent 5dc2cbafef
commit 0bd68bf986
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/or/rendcache.c
View File

@ -222,9 +222,11 @@ rend_cache_free_all(void)
{ {
strmap_free(rend_cache, rend_cache_entry_free_); strmap_free(rend_cache, rend_cache_entry_free_);
digestmap_free(rend_cache_v2_dir, rend_cache_entry_free_); digestmap_free(rend_cache_v2_dir, rend_cache_entry_free_);
strmap_free(rend_cache_service, rend_cache_entry_free_);
strmap_free(rend_cache_failure, rend_cache_failure_entry_free_); strmap_free(rend_cache_failure, rend_cache_failure_entry_free_);
rend_cache = NULL; rend_cache = NULL;
rend_cache_v2_dir = NULL; rend_cache_v2_dir = NULL;
rend_cache_service = NULL;
rend_cache_failure = NULL; rend_cache_failure = NULL;
rend_cache_total_allocation = 0; rend_cache_total_allocation = 0;
} }
@ -715,8 +717,6 @@ rend_cache_store_v2_desc_as_service(const char *desc)
log_warn(LD_REND, "Couldn't compute service ID."); log_warn(LD_REND, "Couldn't compute service ID.");
goto err; goto err;
} }
/* We don't care about the introduction points. */
tor_free(intro_content);
/* Do we already have a newer descriptor? Allow new descriptors with a /* Do we already have a newer descriptor? Allow new descriptors with a
rounded timestamp equal to or newer than the current descriptor */ rounded timestamp equal to or newer than the current descriptor */
@ -726,6 +726,8 @@ rend_cache_store_v2_desc_as_service(const char *desc)
"service ID %s.", safe_str_client(service_id)); "service ID %s.", safe_str_client(service_id));
goto okay; goto okay;
} }
/* We don't care about the introduction points. */
tor_free(intro_content);
if (!e) { if (!e) {
e = tor_malloc_zero(sizeof(rend_cache_entry_t)); e = tor_malloc_zero(sizeof(rend_cache_entry_t));
strmap_set_lc(rend_cache_service, service_id, e); strmap_set_lc(rend_cache_service, service_id, e);