[tor-bugs] #12848 [Tor]: Tor wrongly process circuit as connected to n_chan even if create cell delivery not even tried

[Tor Bug Tracker & Wiki]

#12848: Tor wrongly process circuit as connected to n_chan even if create cell
delivery not even tried
-----------------------------+--------------------------------
     Reporter:  cypherpunks  |      Owner:
         Type:  defect       |     Status:  new
     Priority:  normal       |  Milestone:
    Component:  Tor          |    Version:  Tor: 0.2.5.5-alpha
   Resolution:               |   Keywords:
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+--------------------------------

Comment (by cypherpunks):

 {{{
 --- circuitbuild.c.orig
 +++ circuitbuild.c
 @@ -658,18 +658,19 @@
      static ratelim_t circid_warning_limit = RATELIM_INIT(9600);
      log_fn_ratelim(&circid_warning_limit, LOG_WARN, LD_CIRC,
                     "failed to get unique circID.");
 -    return -1;
 +    goto error;
    }
 -  log_debug(LD_CIRC,"Chosen circID %u.", (unsigned)id);
 -  circuit_set_n_circid_chan(circ, id, circ->n_chan);

    memset(&cell, 0, sizeof(cell_t));
    r = relayed ? create_cell_format_relayed(&cell, create_cell)
                : create_cell_format(&cell, create_cell);
    if (r < 0) {
      log_warn(LD_CIRC,"Couldn't format create cell");
 -    return -1;
 +    goto error;
    }
 +  log_debug(LD_CIRC,"Chosen circID %u.", (unsigned)id);
 +  circuit_set_n_circid_chan(circ, id, circ->n_chan);
 +
    cell.circ_id = circ->n_circ_id;

    append_cell_to_circuit_queue(circ, circ->n_chan, &cell,
 @@ -693,6 +694,8 @@
    }

    return 0;
 +error:
 +  return -1;
  }

  /** We've decided to start our reachability testing. If all
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12848#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online