mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-20 02:09:24 +01:00
Code Issues Projects Releases Wiki Activity

Avoid double-free on failure to dump_descriptor() a cached md

Browse Source 
This is a fix for 10423, which was introducd in caa0d15c in 0.2.4.13-alpha.

Spotted by bobnomnom.
This commit is contained in:
Nick Mathewson 2013-12-17 13:12:52 -05:00
parent 59f50c80d4
commit 46b3b6208d
2 changed files with 26 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/bug10423 Normal file
View File

@ -0,0 +1,4 @@
o Minor bugfixes:
- If we fail to dump a previously cached microdescriptor to disk, avoid
freeing duplicate data later on. Fix for bug 10423; bugfix on
0.2.4.13-alpha. Spotted by "bobnomnom".

33
src/or/microdesc.c
View File

@ -407,6 +407,26 @@ should_rebuild_md_cache(microdesc_cache_t *cache)
return 0;
}
/**
* Mark <b>md</b> as having no body, and release any storage previously held
* by its body.
*/
static void
microdesc_wipe_body(microdesc_t *md)
{
if (!md)
return;
if (md->saved_location != SAVED_IN_CACHE)
tor_free(md->body);
md->off = 0;
md->saved_location = SAVED_NOWHERE;
md->body = NULL;
md->bodylen = 0;
md->no_save = 1;
}
/** Regenerate the main cache file for <b>cache</b>, clear the journal file,
* and update every microdesc_t in the cache with pointers to its new
* location. If <b>force</b> is true, do this unconditionally. If
@ -455,12 +475,7 @@ microdesc_cache_rebuild(microdesc_cache_t *cache, int force)
size = dump_microdescriptor(fd, md, &annotation_len);
if (size < 0) {
if (md->saved_location != SAVED_IN_CACHE)
tor_free(md->body);
md->saved_location = SAVED_NOWHERE;
md->off = 0;
md->bodylen = 0;
md->no_save = 1;
microdesc_wipe_body(md);
/* rewind, in case it was a partial write. */
tor_fd_setpos(fd, off);
@ -497,11 +512,7 @@ microdesc_cache_rebuild(microdesc_cache_t *cache, int force)
HT_FOREACH(mdp, microdesc_map, &cache->map) {
microdesc_t *md = *mdp;
if (md->saved_location == SAVED_IN_CACHE) {
md->off = 0;
md->saved_location = SAVED_NOWHERE;
md->body = NULL;
md->bodylen = 0;
md->no_save = 1;
microdesc_wipe_body(md);
}
}
return -1;