commit bbb73eaf31d3df5cde70ac4ca7145ffca053d53e Author: Sebastian Hahn sebastian@torproject.org Date: Sat Aug 29 17:00:51 2015 +0200

properly delete current channel in channel_free_list

channel_unregister() removes channels from the current smartlist while we're in a SMORTLIST_FOREACH loop. This only works by accident. --- changes/bug16924 | 6 ++++++ src/or/channel.c | 1 + 2 files changed, 7 insertions(+)

diff --git a/changes/bug16924 b/changes/bug16924 new file mode 100644 index 0000000..a1bc96e --- /dev/null +++ b/changes/bug16924 @@ -0,0 +1,6 @@ + o Minor bugfixes: + - When calling channel_free_list(), avoid calling smartlist_remove() + while inside a FOREACH loop. This partially reverts commit + 17356fe7fd96af where the correct SMARTLIST_DEL_CURRENT was + removed. Fixes bug 16929; bugfix on 0.2.4.4-alpha. + diff --git a/src/or/channel.c b/src/or/channel.c index af09502..21522a5 100644 --- a/src/or/channel.c +++ b/src/or/channel.c @@ -3069,6 +3069,7 @@ channel_free_list(smartlist_t *channels, int mark_for_close) if (curr->cmux) { circuitmux_detach_all_circuits(curr->cmux, NULL); } + SMARTLIST_DEL_CURRENT(channels, curr); channel_unregister(curr); if (mark_for_close) { if (!CHANNEL_CONDEMNED(curr)) {