tor/bug20103 at 20ce9f23dc89847dfc3b70ff1cc9f7ec5bd5d644 - tor - Git with a cup of Datura seeds

nihilist/tor

mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-09-20 21:16:22 +02:00

Nick Mathewson 9b5a19c64b Don't look at any routerstatus_t when the networkstatus is inconsistent

For a brief moment in networkstatus_set_current_consensus(), the old
consensus has been freed, but the node_t objects still have dead
pointers to the routerstatus_t objects within it.  During that
interval, we absolutely must not do anything that would cause Tor to
look at those dangling pointers.

Unfortunately, calling the (badly labeled!) current_consensus macro
or anything else that calls into we_use_microdescriptors_for_circuits(),
can make us look at the nodelist.

The fix is to make sure we identify the main consensus flavor
_outside_ the danger zone, and to make the danger zone much much
smaller.

Fixes bug 20103.  This bug has been implicitly present for AGES; we
just got lucky for a very long time.  It became a crash bug in
0.2.8.2-alpha when we merged 35bbf2e4a4 to make
find_dl_schedule start looking at the consensus, and 4460feaf28
which made node_get_all_orports less (accidentally) tolerant of
nodes with a valid ri pointer but dangling rs pointer.

2016-09-20 10:43:58 -04:00

8 lines

354 B

Plaintext

Raw Blame History

   o Major bug fixes (crash):
     - Fix a complicated crash bug that could affect Tor clients
       configured to use bridges when replacing a networkstatus consensus
       in which one of their bridges was mentioned. OpenBSD users saw
       more crashes here, but all platforms were potentially affected.
       Fixes bug 20103; bugfix on 0.2.8.2-alpha.