Fix crash when changing node restrictions with DNS lookup in progress

Fixes bug 4259, bugfix on 0.2.2.25-alpha.  Bugfix by "Tey'".

Original message by submitter:

  Changing nodes restrictions using a controller while Tor is doing
  DNS resolution could makes Tor crashes (on WinXP at least). The
  problem can be repeated by trying to reach a non-existent domain
  using Tor:

    curl --socks4a 127.0.0.1:9050 inexistantdomain.ext

  .. and changing the ExitNodes parameter through the control port
  before Tor returns a DNS resolution error (of course, the following
  command won't work directly if the control port is password
  protected):

    echo SETCONF ExitNodes=TinyTurtle | nc -v 127.0.0.1 9051

  Using a non-existent domain is needed to repeat the issue so that
  Tor takes a few seconds for resolving the domain (which allows us to
  change the configuration). Tor will crash while processing the
  configuration change.

  The bug is located in the addressmap_clear_excluded_trackexithosts
  method which iterates over the entries of the addresses map in order
  to check whether the changes made to the configuration will impact
  those entries. When a DNS resolving is in progress, the new_adress
  field of the associated entry will be set to NULL. The method
  doesn't expect this field to be NULL, hence the crash.
This commit is contained in:
Nick Mathewson 2011-10-19 23:14:05 -04:00
parent 56180d169a
commit 5aa45ed6af
2 changed files with 8 additions and 1 deletions

4
changes/bug4259 Normal file
View File

@ -0,0 +1,4 @@
o Major bugfixes:
- Fix a crash bug when changing node restrictions while a DNS lookup
is in-progress. Fixes bug 4259; bugfix on 0.2.2.25-alpha. Bugfix
by "Tey'".

View File

@ -831,7 +831,10 @@ addressmap_clear_excluded_trackexithosts(or_options_t *options)
char *nodename;
routerinfo_t *ri; /* XXX023 Use node_t. */
if (strcmpend(target, ".exit")) {
if (!target) {
/* DNS resolving in progress */
continue;
} else if (strcmpend(target, ".exit")) {
/* Not a .exit mapping */
continue;
} else if (ent->source != ADDRMAPSRC_TRACKEXIT) {