tor/changes/trove-2017-004
David Goulet 79b59a2dfc TROVE-2017-004: Fix assertion failure in relay_send_end_cell_from_edge_
This fixes an assertion failure in relay_send_end_cell_from_edge_() when an
origin circuit and a cpath_layer = NULL were passed.

A service rendezvous circuit could do such a thing when a malformed BEGIN cell
is received but shouldn't in the first place because the service needs to send
an END cell on the circuit for which it can not do without a cpath_layer.

Fixes #22493

Reported-by: Roger Dingledine <arma@torproject.org>
Signed-off-by: David Goulet <dgoulet@torproject.org>
2017-06-08 09:14:10 -04:00

6 lines
307 B
Plaintext

o Major bugfixes (hidden service, relay):
- Fix an assertion failure when an hidden service handles a malformed
BEGIN cell. This bug resulted in the service crashing triggered by a
tor_assert(). Part of TROVE-2017-004. Fixes bug 22493; bugfix on
tor-0.3.0.1-alpha. Found by armadev.