[tor-bugs] #14803 [Tor]: Tor segfault with hidden service SETCONF

[Tor Bug Tracker & Wiki]

#14803: Tor segfault with hidden service SETCONF
----------------------+---------------------
 Reporter:  atagar    |          Owner:
     Type:  defect    |         Status:  new
 Priority:  critical  |      Milestone:
Component:  Tor       |        Version:
 Keywords:            |  Actual Points:
Parent ID:            |         Points:
----------------------+---------------------
 The following commit...

   https://gitweb.torproject.org/tor.git/commit/?id=44e9daf

 Introduces a regression where SETCONF for hidden services triggers
 sadness. Caught because stem's integ tests no longer pass...

 {{{
 atagar at odin:~/Desktop/stem$ cat test/data/torrc
 # configuration for stem integration tests
 DataDirectory /home/atagar/Desktop/stem/test/data
 SocksListenAddress 127.0.0.1:1112
 DownloadExtraInfo 1
 Log notice stdout
 Log notice file /home/atagar/Desktop/stem/test/data/tor_log
 ControlPort 1111

 atagar at odin:~/Desktop/stem$ tor -f test/data/torrc
 }}}

 Then to trigger it...

 {{{
 atagar at odin:~/Desktop/tor/tor$ telnet localhost 1111
 Trying 127.0.0.1...
 Connected to localhost.
 Escape character is '^]'.
 AUTHENTICATE
 250 OK
 GETCONF HiddenServiceOptions
 250 HiddenServiceOptions
 Connection closed by foreign host.
 atagar at odin:~/Desktop/tor/tor$ telnet localhost 1111
 Trying 127.0.0.1...
 Connected to localhost.
 Escape character is '^]'.
 AUTHENTICATE
 250 OK
 SETCONF
 HiddenServiceDir="/home/atagar/Desktop/stem/test/data/test_hidden_service2"
 HiddenServicePort="8030 127.0.0.1:8030" HiddenServicePort="8031
 127.0.0.1:8031" HiddenServicePort="8032 127.0.0.1:8032"
 HiddenServiceAuthorizeClient="stealth a, b"
 HiddenServiceDir="/home/atagar/Desktop/stem/test/data/test_hidden_service_empty"
 HiddenServiceDir="/home/atagar/Desktop/stem/test/data/test_hidden_service1"
 HiddenServicePort="8020 127.0.0.1:8020" HiddenServicePort="8021
 127.0.0.1:8021" HiddenServiceVersion="2"
 Connection closed by foreign host.
 }}}

 And tor will spew...

 {{{
 Feb 08 18:37:54.000 [warn] ControlPort is open, but no authentication
 method has been configured.  This means that any program on your computer
 can reconfigure your Tor.  That's bad!  You should upgrade your Tor
 controller as soon as possible.

 ============================================================ T= 1423449474
 Tor 0.2.6.2-alpha-dev (git-44e9dafb67370aa6) died: Caught signal 11
 tor(+0x121f0e)[0xb76e4f0e]
 /lib/i386-linux-gnu/libc.so.6(+0x7663e)[0xb71a563e]
 /lib/i386-linux-gnu/libc.so.6(+0x7663e)[0xb71a563e]
 tor(smartlist_free+0x38)[0xb76ea138]
 tor(rend_config_services+0x4f9)[0xb7617379]
 tor(+0xc19aa)[0xb76849aa]
 tor(options_trial_assign+0xb4)[0xb7689384]
 tor(+0xe49c1)[0xb76a79c1]
 tor(connection_control_process_inbuf+0x6e4)[0xb76aba34]
 tor(+0xca584)[0xb768d584]
 tor(connection_handle_read+0x7c7)[0xb7693bf7]
 tor(+0x28d51)[0xb75ebd51]
 /usr/lib/libevent-2.0.so.5(event_base_loop+0x209)[0xb750dce9]
 tor(do_main_loop+0x1bb)[0xb75ec73b]
 tor(tor_main+0x1f6d)[0xb75f00fd]
 tor(main+0x33)[0xb75e89a3]
 /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf3)[0xb71484d3]
 tor(+0x259ed)[0xb75e89ed]
 Aborted
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/14803>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online