nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-30 23:53:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix a read of a freed pointer while in set_current_consensus

Browse Source 
Found by rransom while working on issue #988.  Bugfix on
0.2.2.17-alpha.  Fixes bug 2097.
This commit is contained in:
Nick Mathewson 2010-10-20 12:34:02 -04:00
parent f3d000f496
commit 98aee8472f
2 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/set_ns_crash Normal file
View File

@ -0,0 +1,4 @@
o Major bugfixes:
- Avoid a crash bug triggered by looking at a dangling pointer while
setting the network status consensus. Found by Robert Ransom.
Bugfix on 0.2.2.17-alpha. Fixes bug 2097.

18
src/or/networkstatus.c
View File

@ -1706,6 +1706,10 @@ networkstatus_set_current_consensus(const char *consensus,
if (current_consensus) {
networkstatus_copy_old_consensus_info(c, current_consensus);
networkstatus_vote_free(current_consensus);
/* Defensive programming : we should set current_consensus very soon,
* but we're about to call some stuff in the meantime, and leaving this
* dangling pointer around has proven to be trouble. */
current_consensus = NULL;
}
}
@ -1731,13 +1735,6 @@ networkstatus_set_current_consensus(const char *consensus,
download_status_failed(&consensus_dl_status[flav], 0);
}
if (directory_caches_dir_info(options)) {
dirserv_set_cached_consensus_networkstatus(consensus,
flavor,
&c->digests,
c->valid_after);
}
if (flav == USABLE_CONSENSUS_FLAVOR) {
current_consensus = c;
c = NULL; /* Prevent free. */
@ -1754,6 +1751,13 @@ networkstatus_set_current_consensus(const char *consensus,
circuit_build_times_new_consensus_params(&circ_times, current_consensus);
}
if (directory_caches_dir_info(options)) {
dirserv_set_cached_consensus_networkstatus(consensus,
flavor,
&c->digests,
c->valid_after);
}
if (!from_cache) {
write_str_to_file(consensus_fname, consensus, 0);
}