#5541: NULL ptr deref. in connection_edge_process_relay_cell()
-----------------------+----------------------------------------------------
Reporter: asn | Owner:
Type: defect | Status: new
Priority: normal | Milestone: Tor: 0.2.3.x-final
Component: Tor Relay | Version:
Keywords: | Parent:
Points: | Actualpoints:
-----------------------+----------------------------------------------------
In `connection_edge_process_relay_cell()`, if `conn` is `NULL` (because
`!rh.stream_id` in `relay_lookup_conn()`), and the cell command is
`RELAY_COMMAND_DATA`; if it gets inside:
{{{
if (( layer_hint && --layer_hint->deliver_window < 0) ||
(!layer_hint && --circ->deliver_window < 0)) {
}}}
it can cause a NULL pointer dereference in `connection_edge_end()`, since
the check for `(!conn)` happens after that `if` statement.
I suspect that this can be triggered if you spam an OR to reduce its
`deliver_window` to 0, and then send a `RELAY_COMMAND_DATA` cell with no
`stream_id`.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5541>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online