[tor-bugs] #4343 [Tor Relay]: Tor seg faults: free(): invalid pointer

[Tor Bug Tracker & Wiki]

#4343: Tor seg faults: free(): invalid pointer
-----------------------+----------------------------------------------------
 Reporter:  arma       |          Owner:                    
     Type:  defect     |         Status:  new               
 Priority:  major      |      Milestone:  Tor: 0.2.3.x-final
Component:  Tor Relay  |        Version:                    
 Keywords:             |         Parent:                    
   Points:             |   Actualpoints:                    
-----------------------+----------------------------------------------------

Comment(by arma):

 Here's a piece of the stack trace from when moria1 died:
 {{{
 #16 0x00007f1d66a8cad6 in malloc_printerr (action=3,
     str=0x7f1d66b40b75 "free(): invalid pointer", ptr=<value optimized
 out>)
     at malloc.c:6267
 #17 0x00007f1d66a9184c in *__GI___libc_free (mem=<value optimized out>)
     at malloc.c:3739
 #18 0x00000000004df504 in tor_cert_free (cert=0x7f1d5e843070) at
 tortls.c:696
 #19 0x000000000048efe8 in or_handshake_state_free (state=0x7f1d5c4371e0)
     at connection_or.c:1595
 #20 0x000000000048f981 in connection_or_set_state_open
 (conn=0x7f1d5c9d0530)
     at connection_or.c:1714
 #21 0x00000000004711af in command_process_netinfo_cell
 (cell=0x7f1d5c9d05c8,
     conn=0x7f1d5c9d0530) at command.c:868
 #22 command_process_cell (cell=0x7f1d5c9d05c8, conn=0x7f1d5c9d0530)
     at command.c:194
 #23 0x000000000049065a in connection_or_process_cells_from_inbuf (
     conn=0x7f1d5c9d0530) at connection_or.c:1822
 #24 0x0000000000484a39 in connection_handle_read_impl
 (conn=0x7f1d5c9d0530)
     at connection.c:2701
 #25 connection_handle_read (conn=0x7f1d5c9d0530) at connection.c:2741
 }}}

 Now it dies reliably on startup.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4343#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online