r12434@catbus: nickm | 2007-04-19 11:23:35 -0400

When advancing a string pointer, make sure we do not later free the altered pointer.  Fixes bug 416, introduced in r9971.


svn:r9990
This commit is contained in:
Nick Mathewson 2007-04-19 15:23:38 +00:00
parent addf2987c5
commit bf4f0539cf

View File

@ -1685,6 +1685,7 @@ directory_handle_command_get(dir_connection_t *conn, const char *headers,
if (!strcmpstart(url,"/tor/server/") ||
!strcmpstart(url,"/tor/extra/")) {
char *url_mem = url;
size_t url_len = strlen(url);
int deflated = !strcmp(url+url_len-2, ".z");
int res;
@ -1724,7 +1725,7 @@ directory_handle_command_get(dir_connection_t *conn, const char *headers,
else
conn->dir_spool_src =
is_extra ? DIR_SPOOL_EXTRA_BY_FP : DIR_SPOOL_SERVER_BY_FP;
tor_free(url);
tor_free(url_mem);
if (res < 0)
write_http_status_line(conn, 404, msg);
else {