[tor-bugs] #3367 [Tor Client]: Tor 0.2.3.x segfaults on SIGNAL TERM

[Tor Bug Tracker & Wiki]

#3367: Tor 0.2.3.x segfaults on SIGNAL TERM
------------------------+---------------------------------------------------
 Reporter:  rransom     |          Owner:  nickm             
     Type:  defect      |         Status:  assigned          
 Priority:  major       |      Milestone:  Tor: 0.2.3.x-final
Component:  Tor Client  |        Version:                    
 Keywords:              |         Parent:                    
   Points:              |   Actualpoints:                    
------------------------+---------------------------------------------------
Changes (by nickm):

  * status:  new => assigned
  * owner:  rransom => nickm


Comment:

 Replying to [comment:1 rransom]:
 > {{{
 > (gdb) bt
 > #0  0x0000000000450f65 in flush_buf (s=11, buf=0x0, sz=0,
 >     buf_flushlen=0x8026d20f0) at buffers.c:828

 This is telling; buf shouldn't be 0 if flush_buf has a hope of working.

 Also, we shouldn't be using flush_buf when bufferevents are enabled...

 > #1  0x0000000000476168 in connection_handle_write (conn=0x8026d20c0,
 force=1)
 >     at connection.c:3257
 > #2  0x0000000000487b2b in handle_control_signal (conn=0x8026d20c0,
 len=Variable "len" is not available.
 > )
 >     at control.c:1282

 Oho, here's the trouble; handle_control_signal is calling
 connection_handle_write directly, when it's a buf_t-only function!

 Best have a connection_flush that does the right thing.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3367#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online