nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-24 04:13:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

Avoid double-free on rend_add_service() failure

Browse Source 
Rend_add_service() frees its argument on failure; no need to free again.

Fixes bug 16228, bugfix on 0.2.7.1-alpha

Found by coverity; this is CID 1301387.
This commit is contained in:
Nick Mathewson 2015-05-28 13:23:09 -04:00
parent 97a2dbb3e3
commit 5dce1829bf
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/bug16228 Normal file
View File

@ -0,0 +1,4 @@
o Minor bugfixes (hidden services):
- Avoid crashing with a double-free bug when we create an
ephemeral hidden service but adding it fails for some reason.
Fixes bug 16228; bugfix on 0.2.7.1-alpha.

3
src/or/rendservice.c
View File

@ -256,7 +256,7 @@ rend_service_free_all(void)
} }
/** Validate <b>service</b> and add it to rend_service_list if possible. /** Validate <b>service</b> and add it to rend_service_list if possible.
* Return 0 on success and -1 on failure. * Return 0 on success. On failure, free <b>service</b> and return -1.
*/ */
static int static int
rend_add_service(rend_service_t *service) rend_add_service(rend_service_t *service)
@ -868,7 +868,6 @@ rend_service_add_ephemeral(crypto_pk_t *pk,
/* Initialize the service. */ /* Initialize the service. */
if (rend_add_service(s)) { if (rend_add_service(s)) {
rend_service_free(s);
return RSAE_INTERNAL; return RSAE_INTERNAL;
} }
*service_id_out = tor_strdup(s->service_id); *service_id_out = tor_strdup(s->service_id);