nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-24 12:23:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'public/bug5541_v2'

Browse Source
This commit is contained in:
Nick Mathewson 2012-05-31 12:40:30 -04:00
commit fc5d960fbd
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
changes/bug5541 Normal file
View File

@ -0,0 +1,8 @@
o Minor bugfixes:
- Prevent a null-pointer dereference when receiving a data cell
for a nonexistent stream when the circuit in question has an
empty deliver window. We don't believe this is triggerable,
since we don't currently allow deliver windows to become empty,
but the logic is tricky enough that it's better to make the code
robust. Fixes bug 5541; bugfix on 0.0.2pre14.

8
src/or/relay.c
View File

@ -1125,8 +1125,12 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ,
(!layer_hint && --circ->deliver_window < 0)) {
log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
"(relay data) circ deliver_window below 0. Killing.");
connection_edge_end(conn, END_STREAM_REASON_TORPROTOCOL);
connection_mark_for_close(TO_CONN(conn));
if (conn) {
/* XXXX Do we actually need to do this? Will killing the circuit
* not send an END and mark the stream for close as appropriate? */
connection_edge_end(conn, END_STREAM_REASON_TORPROTOCOL);
connection_mark_for_close(TO_CONN(conn));
}
return -END_CIRC_REASON_TORPROTOCOL;
}
log_debug(domain,"circ deliver_window now %d.", layer_hint ?