[tor-bugs] #20103 [Core Tor/Tor]: Crash on OpenBSD: tor invoked from Tor Browser 6.0.4

[Tor Bug Tracker & Wiki]

#20103: Crash on OpenBSD: tor invoked from Tor Browser 6.0.4
-----------------------------------------+---------------------------------
 Reporter:  attila                       |          Owner:
     Type:  defect                       |         Status:  new
 Priority:  High                         |      Milestone:  Tor:
                                         |  0.2.9.x-final
Component:  Core Tor/Tor                 |        Version:  Tor: 0.2.8.7
 Severity:  Normal                       |     Resolution:
 Keywords:  bug regression 028-backport  |  Actual Points:
Parent ID:                               |         Points:
 Reviewer:                               |        Sponsor:
-----------------------------------------+---------------------------------

Comment (by nickm):

 Oh MAN.  When we free the consensus earlier (line 1662) in
 networkstatus_vote_free, we don't  we don't invalidate all the
 routerstatus_t objects that the node_t structures point to.  But they are
 used deep inside download_status_reset().  Tricky!

 Could you tell me what exact version of Tor you were testing on debian
 above?  I want to make sure that it is
 "networkstatus_free(current_md_consensus)" that's on line
 src/or/networkstatus.c:1662 , not some other networkstatus_free().

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20103#comment:13>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online