mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2025-02-24 22:58:50 +01:00
Code Issues Projects Releases Wiki Activity
tor/changes/bug20103

8 lines
354 B
Text
Raw Normal View History

Don't look at any routerstatus_t when the networkstatus is inconsistent For a brief moment in networkstatus_set_current_consensus(), the old consensus has been freed, but the node_t objects still have dead pointers to the routerstatus_t objects within it. During that interval, we absolutely must not do anything that would cause Tor to look at those dangling pointers. Unfortunately, calling the (badly labeled!) current_consensus macro or anything else that calls into we_use_microdescriptors_for_circuits(), can make us look at the nodelist. The fix is to make sure we identify the main consensus flavor _outside_ the danger zone, and to make the danger zone much much smaller. Fixes bug 20103. This bug has been implicitly present for AGES; we just got lucky for a very long time. It became a crash bug in 0.2.8.2-alpha when we merged 35bbf2e4a4e8ccb to make find_dl_schedule start looking at the consensus, and 4460feaf2850ef0 which made node_get_all_orports less (accidentally) tolerant of nodes with a valid ri pointer but dangling rs pointer.
2016-09-19 12:03:58 -04:00
o Major bug fixes (crash):
- Fix a complicated crash bug that could affect Tor clients
configured to use bridges when replacing a networkstatus consensus
in which one of their bridges was mentioned. OpenBSD users saw
more crashes here, but all platforms were potentially affected.
Fixes bug 20103; bugfix on 0.2.8.2-alpha.
Reference in a new issue Copy permalink