diff --git a/changes/bug10423 b/changes/bug10423
new file mode 100644
index 0000000000..493b7b15e3
--- /dev/null
+++ b/changes/bug10423
@@ -0,0 +1,4 @@
+ o Minor bugfixes:
+ - If we fail to dump a previously cached microdescriptor to disk, avoid
+ freeing duplicate data later on. Fix for bug 10423; bugfix on
+ 0.2.4.13-alpha. Spotted by "bobnomnom".
diff --git a/src/or/microdesc.c b/src/or/microdesc.c
index 8b5581f4af..18d26c98ab 100644
--- a/src/or/microdesc.c
+++ b/src/or/microdesc.c
@@ -407,6 +407,26 @@ should_rebuild_md_cache(microdesc_cache_t *cache)
return 0;
}
+/**
+ * Mark md as having no body, and release any storage previously held
+ * by its body.
+ */
+static void
+microdesc_wipe_body(microdesc_t *md)
+{
+ if (!md)
+ return;
+
+ if (md->saved_location != SAVED_IN_CACHE)
+ tor_free(md->body);
+
+ md->off = 0;
+ md->saved_location = SAVED_NOWHERE;
+ md->body = NULL;
+ md->bodylen = 0;
+ md->no_save = 1;
+}
+
/** Regenerate the main cache file for cache, clear the journal file,
* and update every microdesc_t in the cache with pointers to its new
* location. If force is true, do this unconditionally. If
@@ -455,12 +475,7 @@ microdesc_cache_rebuild(microdesc_cache_t *cache, int force)
size = dump_microdescriptor(fd, md, &annotation_len);
if (size < 0) {
- if (md->saved_location != SAVED_IN_CACHE)
- tor_free(md->body);
- md->saved_location = SAVED_NOWHERE;
- md->off = 0;
- md->bodylen = 0;
- md->no_save = 1;
+ microdesc_wipe_body(md);
/* rewind, in case it was a partial write. */
tor_fd_setpos(fd, off);
@@ -497,11 +512,7 @@ microdesc_cache_rebuild(microdesc_cache_t *cache, int force)
HT_FOREACH(mdp, microdesc_map, &cache->map) {
microdesc_t *md = *mdp;
if (md->saved_location == SAVED_IN_CACHE) {
- md->off = 0;
- md->saved_location = SAVED_NOWHERE;
- md->body = NULL;
- md->bodylen = 0;
- md->no_save = 1;
+ microdesc_wipe_body(md);
}
}
return -1;