nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-28 06:13:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Don't access rend data after a circuit has been marked for close.

Browse Source 
This can cause issues if the circuit was repurposed into a padding circuit
instead of closing, since in that case we will wipe off the rend_data.
This commit is contained in:
George Kadianakis 2019-06-05 18:19:23 +03:00
parent 7f341d6482
commit 917e4e9eae
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/feature/rend/rendclient.c
View File

@ -403,14 +403,23 @@ rend_client_introduction_acked(origin_circuit_t *circ,
} else {
log_info(LD_REND,"...Found no rend circ. Dropping on the floor.");
}
/* Save the rend data digest to a temporary object so that we don't access
* it after we mark the circuit for close. */
const uint8_t *rend_digest_tmp = NULL;
size_t digest_len;
uint8_t *cached_rend_digest = NULL;
rend_digest_tmp = rend_data_get_pk_digest(circ->rend_data, &digest_len);
cached_rend_digest = tor_malloc_zero(digest_len);
memcpy(cached_rend_digest, rend_digest_tmp, digest_len);
/* close the circuit: we won't need it anymore. */
circuit_change_purpose(TO_CIRCUIT(circ),
CIRCUIT_PURPOSE_C_INTRODUCE_ACKED);
circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_FINISHED);
/* close any other intros launched in parallel */
rend_client_close_other_intros(rend_data_get_pk_digest(circ->rend_data,
NULL));
rend_client_close_other_intros(cached_rend_digest);
tor_free(cached_rend_digest); /* free the temporary digest */
} else {
/* It's a NAK; the introduction point didn't relay our request. */
circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_C_INTRODUCING);