[tor-bugs] #15776 [Tor]: assert_circuit_ok: Assertion c == c2 failed; aborting.

[Tor Bug Tracker & Wiki]

#15776: assert_circuit_ok: Assertion c == c2 failed; aborting.
----------------------------+---------------------------
     Reporter:  Spider.007  |      Owner:
         Type:  defect      |     Status:  new
     Priority:  major       |  Milestone:
    Component:  Tor         |    Version:  Tor: 0.2.5.12
   Resolution:              |   Keywords:
Actual Points:              |  Parent ID:
       Points:              |
----------------------------+---------------------------

Comment (by Spider.007):

 4 hours after restarting  I got:
 {{{
 *** Error in `/usr/bin/tor': free(): invalid next size (fast):
 0x00007f341e6d5d60 ***
 ======= Backtrace: =========
 /usr/lib/libc.so.6(+0x7198e)[0x7f3411f4198e]
 /usr/lib/libc.so.6(+0x76dee)[0x7f3411f46dee]
 /usr/lib/libc.so.6(+0x775cb)[0x7f3411f475cb]
 /usr/bin/tor(circuitmux_detach_circuit+0x100)[0x7f34135b40b0]
 /usr/bin/tor(circuit_mark_for_close_+0x229)[0x7f34135b0e79]
 /usr/bin/tor(command_process_cell+0x499)[0x7f34135bf019]
 /usr/bin/tor(channel_tls_handle_cell+0x20b)[0x7f34135a29db]
 /usr/bin/tor(+0xd1184)[0x7f34135e0184]
 /usr/bin/tor(+0xc8175)[0x7f34135d7175]
 /usr/bin/tor(+0x31031)[0x7f3413540031]
 /usr/lib/libevent-2.0.so.5(event_base_loop+0x806)[0x7f3412b97ca6]
 /usr/bin/tor(do_main_loop+0x195)[0x7f3413541815]
 /usr/bin/tor(tor_main+0x16e5)[0x7f3413544625]
 /usr/lib/libc.so.6(__libc_start_main+0xf0)[0x7f3411ef0800]
 /usr/bin/tor(_start+0x29)[0x7f341353ddb9]
 ======= Memory map: ========
 }}}

 Not sure if this is related to the original assertion, could this somehow
 be related to http://www.openwall.com/lists/oss-security/2015/04/21/4 ?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/15776#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online