commit 3b64c6b6fc1f41ccfae99b49a56f134ba6ee7662 Author: David Goulet dgoulet@torproject.org Date: Tue Dec 3 10:11:42 2019 -0500

hs-v3: Fix NULL deref. in hs_circ_service_get_established_intro_circ()

Found by Stem regression tests. Reported by atagar.

Fixes #32664

Signed-off-by: David Goulet dgoulet@torproject.org --- src/feature/hs/hs_circuit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/feature/hs/hs_circuit.c b/src/feature/hs/hs_circuit.c index a43e7f0e2..a09e31972 100644 --- a/src/feature/hs/hs_circuit.c +++ b/src/feature/hs/hs_circuit.c @@ -673,7 +673,8 @@ hs_circ_service_get_established_intro_circ(const hs_service_intro_point_t *ip) }

/* Only return circuit if it is established. */ - return (TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_INTRO) ? circ : NULL; + return (circ && TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_INTRO) ? + circ : NULL; }

/** Called when we fail building a rendezvous circuit at some point other than