mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-10 13:13:44 +01:00
Merge remote-tracking branch 'teor/bug21576_029_v2' into maint-0.3.0
This commit is contained in:
commit
333d5d0f2a
4
changes/bug21576
Normal file
4
changes/bug21576
Normal file
@ -0,0 +1,4 @@
|
||||
o Major bugfixes (crash, directory connections):
|
||||
- Fix a rare crash when sending a begin cell on a circuit whose linked
|
||||
directory connection has already been closed. Fixes bug 21576;
|
||||
bugfix on Tor 0.2.9.3-alpha. Reported by alecmuffett.
|
@ -2514,10 +2514,16 @@ connection_ap_handshake_send_begin(entry_connection_t *ap_conn)
|
||||
} else if (begin_type == RELAY_COMMAND_BEGIN_DIR) {
|
||||
/* This connection is a begindir directory connection.
|
||||
* Look at the linked directory connection to access the directory purpose.
|
||||
* (This must be non-NULL, because we're doing begindir.) */
|
||||
tor_assert(base_conn->linked);
|
||||
* If a BEGINDIR connection is ever not linked, that's a bug. */
|
||||
if (BUG(!base_conn->linked)) {
|
||||
return -1;
|
||||
}
|
||||
connection_t *linked_dir_conn_base = base_conn->linked_conn;
|
||||
tor_assert(linked_dir_conn_base);
|
||||
/* If the linked connection has been unlinked by other code, we can't send
|
||||
* a begin cell on it. */
|
||||
if (!linked_dir_conn_base) {
|
||||
return -1;
|
||||
}
|
||||
/* Sensitive directory connections must have an anonymous path length.
|
||||
* Otherwise, directory connections are typically one-hop.
|
||||
* This matches the earlier check for directory connection path anonymity
|
||||
|
Loading…
Reference in New Issue
Block a user