[tor-bugs] #5072 [Obfsproxy]: obfsproxy assertion failure src/network.c:726: down->buffer == bev

[Tor Bug Tracker & Wiki]

#5072: obfsproxy assertion failure src/network.c:726: down->buffer == bev
-----------------------+----------------------------------------------------
 Reporter:  arma       |          Owner:  asn
     Type:  defect     |         Status:  new
 Priority:  major      |      Milestone:     
Component:  Obfsproxy  |        Version:     
 Keywords:             |         Parent:     
   Points:             |   Actualpoints:     
-----------------------+----------------------------------------------------

Comment(by arma):

 Replying to [comment:8 asn]:
 > I wonder how:
 > {{{
 > if (down->buffer != bev) {
 >     conn_free(down);
 >     return;
 > }
 > }}}
 > in the top of `downstream_read_cb()`, would act as an anti-crash
 temporary workaround.
 >
 > `conn_free(down);` might make it too much undefined behavior, maybe just
 returning and suffering the memory leak could also work.
 >
 > Messy, but it might do it for the weekend.

 I'm running this patch, and it crashes less. Specifically, it just
 encountered an area where it would have asserted, and it didn't.

 {{{
 [debug] error_cb for 127.0.0.1:9009: what=0x0011 errno=11
 [info] EOF from 127.0.0.1:9009
 [debug] error_or_eof for 127.0.0.1:9009
 [debug] 127.0.0.1:9009: downstream_read_cb, 586 bytes available
 [warn] downstream_read_cb: bev: '0xa1ef40' down->buffer:'0xa1f380', down:
 '0xa1f6f0'
 [warn] bev == down->circuit->upstream->buffer: 0
 bev == down->circuit->downstream->buffer: 1
 down->buffer == down->circuit->upstream->buffer: 1
 down->buffer == down->circuit->downstream->buffer: 0

 [debug] Closing connection with 127.0.0.1:9009; 1 remaining
 [debug] Closing connection with x.x.x.x:10819; 0 remaining
 }}}

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5072#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online