diff --git a/changes/bug7947 b/changes/bug7947 new file mode 100644 index 0000000000..6200ba2d8a --- /dev/null +++ b/changes/bug7947 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Fix the handling of a TRUNCATE cell when it arrives while the circuit + extension is in progress. Fixes bug 7947; bugfix on 0.0.7.1. + diff --git a/src/or/relay.c b/src/or/relay.c index 9ff9e1e1f4..8e80d14a87 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1398,6 +1398,14 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "'truncate' unsupported at origin. Dropping."); return 0; } + if (circ->n_hop) { + if (circ->n_chan) + log_warn(LD_BUG, "n_chan and n_hop set on the same circuit!"); + extend_info_free(circ->n_hop); + circ->n_hop = NULL; + tor_free(circ->n_chan_create_cell); + circuit_set_state(circ, CIRCUIT_STATE_OPEN); + } if (circ->n_chan) { uint8_t trunc_reason = get_uint8(cell->payload + RELAY_HEADER_SIZE); circuit_clear_cell_queue(circ, circ->n_chan);