sarah
/
tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Remove redundant tor_free() in command_process_create_cell(). 

* FIXES #16823: https://bugs.torproject.org/16823
   If an OP were to send a CREATE_FAST cell to an OR, and that
   CREATE_FAST cell had unparseable key material, then tor_free() would
   be called on the create cell twice.  This fix removes the second
   (conditional on the key material being bad) call to tor_free(), so
   that now the create cell is always freed once, regardless of the status of
   the key material.

   (This isn't actually a double-free bug, since tor_free() sets its
   input to NULL, and has no effect when called with input NULL.)
This commit is contained in:
Isis Lovecruft 2015-08-16 00:49:03 +00:00 committed by Nick Mathewson
parent a053451ddf
commit 2e0a50abf4
1 changed files with 0 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/or/command.c
View File

@ -340,7 +340,6 @@ command_process_create_cell(cell_t *cell, channel_t *chan)
if (len < 0) {
log_warn(LD_OR,"Failed to generate key material. Closing.");
circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
tor_free(create_cell);
return;
}
created_cell.cell_type = CELL_CREATED_FAST;