[tor-bugs] #11243 [Tor]: Don't fetch any descriptor which we already fetched and found to be ill-formed

[Tor Bug Tracker & Wiki]

#11243: Don't fetch any descriptor which we already fetched and found to be ill-
formed
------------------------+-------------------------------------------------
     Reporter:  nickm   |      Owner:
         Type:  defect  |     Status:  needs_review
     Priority:  major   |  Milestone:  Tor: 0.2.6.x-final
    Component:  Tor     |    Version:
   Resolution:          |   Keywords:  tor-relay 026-triaged-1 nickm-patch
Actual Points:          |  Parent ID:
       Points:          |
------------------------+-------------------------------------------------

Comment (by arma):

 Running moria1 on master (1ce57267), it chokes on startup trying to read
 its cached descriptors:
 {{{
 (gdb) where
 #0  0x00007f2d201ab625 in raise () from /lib64/libc.so.6
 #1  0x00007f2d201ace05 in abort () from /lib64/libc.so.6
 #2  0x00007f2d219590b8 in crash_handler (sig=<value optimized out>,
     si=<value optimized out>, ctx_=<value optimized out>)
     at src/common/backtrace.c:143
 #3  <signal handler called>
 #4  extrainfo_insert (ei=0x7f2d27382500, msg=<value optimized out>,
     from_cache=1, from_fetch=<value optimized out>) at
 src/or/routerlist.c:2963
 #5  router_add_extrainfo_to_routerlist (ei=0x7f2d27382500,
     msg=<value optimized out>, from_cache=1, from_fetch=<value optimized
 out>)
     at src/or/routerlist.c:3508
 #6  0x00007f2d218b5194 in router_load_extrainfo_from_string (
     s=0x7f2d1c0fc84f <Address 0x7f2d1c0fc84f out of bounds>,
     eos=<value optimized out>, saved_location=<value optimized out>,
     requested_fingerprints=0x0, descriptor_digests=0)
     at src/or/routerlist.c:3980
 #7  0x00007f2d218b58a6 in router_reload_router_list_impl
 (store=0x7f2d23caed48)
     at src/or/routerlist.c:1196
 #8  0x00007f2d218b5a6e in router_reload_router_list ()
     at src/or/routerlist.c:1243
 #9  0x00007f2d2186fddb in do_main_loop () at src/or/main.c:1972
 #10 0x00007f2d21871825 in tor_main (argc=<value optimized out>,
     argv=<value optimized out>) at src/or/main.c:2997
 #11 0x00007f2d20197d5d in __libc_start_main () from /lib64/libc.so.6
 #12 0x00007f2d2186e019 in _start ()
 }}}

 {{{
 (gdb) up
 #4  extrainfo_insert (ei=0x7f2d27382500, msg=<value optimized out>,
     from_cache=1, from_fetch=<value optimized out>) at
 src/or/routerlist.c:2963
 2963        r = (sd->extrainfo_is_bogus) ? ROUTER_BAD_EI :
 ROUTER_NOT_IN_CONSENSUS;
 (gdb) print sd
 $1 = (signed_descriptor_t *) 0x0
 }}}

 Looks like it was introduced in git commit 223d354e3:
 {{{
    if (routerinfo_incompatible_with_extrainfo(ri, ei, sd, NULL)) {
 +    r = (sd->extrainfo_is_bogus) ? ROUTER_BAD_EI :
 ROUTER_NOT_IN_CONSENSUS;
      goto done;
    }
 }}}
 where it assumes that sd will be defined.

 ...which is how I ran across this ticket.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/11243#comment:19>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online