commit bd9901bef245b3880c9a60034b9fdf6d4829eb65 Author: Nick Mathewson <nickm@torproject.org> Date: Mon Mar 18 15:55:55 2013 -0400 Handle TRUNCATE correctly if our next channel isn't done yet. Patch from 'cypherpunks'. Fixes bug #7947. Bugfix on 0.0.7.1. --- changes/bug7947 | 4 ++++ src/or/relay.c | 8 ++++++++ 2 files changed, 12 insertions(+), 0 deletions(-) diff --git a/changes/bug7947 b/changes/bug7947 new file mode 100644 index 0000000..6200ba2 --- /dev/null +++ b/changes/bug7947 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Fix the handling of a TRUNCATE cell when it arrives while the circuit + extension is in progress. Fixes bug 7947; bugfix on 0.0.7.1. + diff --git a/src/or/relay.c b/src/or/relay.c index 9ff9e1e..8e80d14 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1398,6 +1398,14 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "'truncate' unsupported at origin. Dropping."); return 0; } + if (circ->n_hop) { + if (circ->n_chan) + log_warn(LD_BUG, "n_chan and n_hop set on the same circuit!"); + extend_info_free(circ->n_hop); + circ->n_hop = NULL; + tor_free(circ->n_chan_create_cell); + circuit_set_state(circ, CIRCUIT_STATE_OPEN); + } if (circ->n_chan) { uint8_t trunc_reason = get_uint8(cell->payload + RELAY_HEADER_SIZE); circuit_clear_cell_queue(circ, circ->n_chan);