[tor-bugs] #4343 [Tor Relay]: Tor seg faults: free(): invalid pointer

[Tor Bug Tracker & Wiki]

#4343: Tor seg faults: free(): invalid pointer
-----------------------+----------------------------------------------------
 Reporter:  arma       |          Owner:                    
     Type:  defect     |         Status:  new               
 Priority:  major      |      Milestone:  Tor: 0.2.3.x-final
Component:  Tor Relay  |        Version:                    
 Keywords:             |         Parent:                    
   Points:             |   Actualpoints:                    
-----------------------+----------------------------------------------------

Comment(by nickm):

 So, if we've got the same code, the tor_free that's failing is
 tor_free(encoded) in tor_cert_free (tortls.c line 696)

 Note that we haven't freed the cert itself before: if we had, we'd be
 seeing different output there, since right after that, we say
 "memset(cert, 0x03, sizeof(cert))".  Whoops.  That should be
 sizeof(*cert).  But either way, I'm not seeing 8 0x03 bytes anywhere in
 there, are you?

 So something else must have freed cert->encoded.  Or I'm analyzing this
 wrong.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4343#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online