commit 981e037fd3b9e20b6e58e9c1470999a0f3a1ef0e Author: Nick Mathewson nickm@torproject.org Date: Tue Aug 12 12:14:05 2014 -0400

Add an extra check in channel_send_destroy for circID==0

Prevents other cases of 12848. --- src/or/channel.c | 8 ++++++++ 1 file changed, 8 insertions(+)

diff --git a/src/or/channel.c b/src/or/channel.c index 1270eac..cd55bd0 100644 --- a/src/or/channel.c +++ b/src/or/channel.c @@ -2625,6 +2625,14 @@ channel_send_destroy(circid_t circ_id, channel_t *chan, int reason) cell_t cell;

tor_assert(chan); + if (circ_id == 0) { + log_warn(LD_BUG, "Attempted to send a destroy cell for circID 0 " + "on a channel " U64_FORMAT " at %p in state %s (%d)", + U64_PRINTF_ARG(chan->global_identifier), + chan, channel_state_to_string(chan->state), + chan->state); + return 0; + }

/* Check to make sure we can send on this channel first */ if (!(chan->state == CHANNEL_STATE_CLOSING ||