nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-12 22:23:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix a use-after-free in validate_intro_point_failure. Bug 17401. Found w valgrind

Browse Source
This commit is contained in:
Nick Mathewson 2015-10-21 09:59:19 -04:00
parent 542cc8a5ff
commit 5b2070198a
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
changes/bug17401 Normal file
View File

@ -0,0 +1,3 @@
o Major bugfixes (correctness):
- Fix a use-after-free bug in validate_intro_point_failure().
Fixes bug 17401; bugfix on 0.2.7.3-rc.

3
src/or/rendcache.c
View File

@ -400,9 +400,10 @@ validate_intro_point_failure(const rend_service_descriptor_t *desc,
/* This intro point is in our cache, discard it from the descriptor /* This intro point is in our cache, discard it from the descriptor
* because chances are that it's unusable. */ * because chances are that it's unusable. */
SMARTLIST_DEL_CURRENT(desc->intro_nodes, intro); SMARTLIST_DEL_CURRENT(desc->intro_nodes, intro);
rend_intro_point_free(intro);
/* Keep it for our new entry. */ /* Keep it for our new entry. */
digestmap_set(new_entry->intro_failures, (char *) identity, ent_dup); digestmap_set(new_entry->intro_failures, (char *) identity, ent_dup);
/* Only free it when we're done looking at it. */
rend_intro_point_free(intro);
continue; continue;
} }
} SMARTLIST_FOREACH_END(intro); } SMARTLIST_FOREACH_END(intro);