mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-19 18:00:33 +01:00
Code Issues Projects Releases Wiki Activity

Set 'routerlist' global to NULL before freeing it.

Browse Source 
There is other code that uses this value, and some of it is
apparently reachable from inside router_dir_info_changed(), which
routerlist_free() apparently calls.  (ouch!)  This is a minimal fix
to try to resolve the issue without causing other problems.

Fixes bug 31003. I'm calling this a bugfix on 0.1.2.2-alpha, where
the call to router_dir_info_changed() was added to routerlist_free().
This commit is contained in:
Nick Mathewson 2019-07-19 09:49:52 -04:00
parent 1dd9527897
commit a9379d6750
2 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/bug31003 Normal file
View File

@ -0,0 +1,4 @@
o Minor bugfixes (crash on exit):
- Avoid a set of possible code paths that could use try to use freed memory
in routerlist_free() while Tor was exiting. Fixes bug 31003; bugfix on
0.1.2.2-alpha.

12
src/feature/nodelist/routerlist.c
View File

@ -954,20 +954,18 @@ routerlist_free_(routerlist_t *rl)
smartlist_free(rl->routers);
smartlist_free(rl->old_routers);
if (rl->desc_store.mmap) {
int res = tor_munmap_file(routerlist->desc_store.mmap);
int res = tor_munmap_file(rl->desc_store.mmap);
if (res != 0) {
log_warn(LD_FS, "Failed to munmap routerlist->desc_store.mmap");
}
}
if (rl->extrainfo_store.mmap) {
int res = tor_munmap_file(routerlist->extrainfo_store.mmap);
int res = tor_munmap_file(rl->extrainfo_store.mmap);
if (res != 0) {
log_warn(LD_FS, "Failed to munmap routerlist->extrainfo_store.mmap");
}
}
tor_free(rl);
router_dir_info_changed();
}
/** Log information about how much memory is being used for routerlist,
@ -1426,8 +1424,10 @@ routerlist_reparse_old(routerlist_t *rl, signed_descriptor_t *sd)
void
routerlist_free_all(void)
{
routerlist_free(routerlist);
routerlist = NULL;
routerlist_t *rl = routerlist;
routerlist = NULL; // Prevent internals of routerlist_free() from using
// routerlist.
routerlist_free(rl);
dirlist_free_all();
if (warned_nicknames) {
SMARTLIST_FOREACH(warned_nicknames, char *, cp, tor_free(cp));