commit 46b3b6208de3e5a5b87b4a33387d18343bc3c851 Author: Nick Mathewson nickm@torproject.org Date: Tue Dec 17 13:12:52 2013 -0500

Avoid double-free on failure to dump_descriptor() a cached md

This is a fix for 10423, which was introducd in caa0d15c in 0.2.4.13-alpha.

Spotted by bobnomnom. --- changes/bug10423 | 4 ++++ src/or/microdesc.c | 33 ++++++++++++++++++++++----------- 2 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/changes/bug10423 b/changes/bug10423 new file mode 100644 index 0000000..493b7b1 --- /dev/null +++ b/changes/bug10423 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - If we fail to dump a previously cached microdescriptor to disk, avoid + freeing duplicate data later on. Fix for bug 10423; bugfix on + 0.2.4.13-alpha. Spotted by "bobnomnom". diff --git a/src/or/microdesc.c b/src/or/microdesc.c index 8b5581f..18d26c9 100644 --- a/src/or/microdesc.c +++ b/src/or/microdesc.c @@ -407,6 +407,26 @@ should_rebuild_md_cache(microdesc_cache_t *cache) return 0; }

+/** + * Mark <b>md</b> as having no body, and release any storage previously held + * by its body. + */ +static void +microdesc_wipe_body(microdesc_t *md) +{ + if (!md) + return; + + if (md->saved_location != SAVED_IN_CACHE) + tor_free(md->body); + + md->off = 0; + md->saved_location = SAVED_NOWHERE; + md->body = NULL; + md->bodylen = 0; + md->no_save = 1; +} + /** Regenerate the main cache file for <b>cache</b>, clear the journal file, * and update every microdesc_t in the cache with pointers to its new * location. If <b>force</b> is true, do this unconditionally. If @@ -455,12 +475,7 @@ microdesc_cache_rebuild(microdesc_cache_t *cache, int force)

size = dump_microdescriptor(fd, md, &annotation_len); if (size < 0) { - if (md->saved_location != SAVED_IN_CACHE) - tor_free(md->body); - md->saved_location = SAVED_NOWHERE; - md->off = 0; - md->bodylen = 0; - md->no_save = 1; + microdesc_wipe_body(md);

/* rewind, in case it was a partial write. */ tor_fd_setpos(fd, off); @@ -497,11 +512,7 @@ microdesc_cache_rebuild(microdesc_cache_t *cache, int force) HT_FOREACH(mdp, microdesc_map, &cache->map) { microdesc_t *md = *mdp; if (md->saved_location == SAVED_IN_CACHE) { - md->off = 0; - md->saved_location = SAVED_NOWHERE; - md->body = NULL; - md->bodylen = 0; - md->no_save = 1; + microdesc_wipe_body(md); } } return -1;