[tor-bugs] #22368 [Core Tor/Tor]: double-free of MyFamily lines

Tor Bug Tracker & Wiki blackhole at torproject.org
Thu May 25 00:31:00 UTC 2017


#22368: double-free of MyFamily lines
--------------------------+------------------------------------
 Reporter:  arma          |          Owner:
     Type:  defect        |         Status:  new
 Priority:  Medium        |      Milestone:  Tor: 0.3.1.x-final
Component:  Core Tor/Tor  |        Version:  Tor: 0.3.1.1-alpha
 Severity:  Normal        |     Resolution:
 Keywords:                |  Actual Points:
Parent ID:                |         Points:
 Reviewer:                |        Sponsor:
--------------------------+------------------------------------
Changes (by arma):

 * keywords:  regression memory-safety tor-relay =>


Comment:

 Here's the patch I'm testing:
 {{{
 diff --git a/src/or/router.c b/src/or/router.c
 index 642f415..f2741b7 100644
 --- a/src/or/router.c
 +++ b/src/or/router.c
 @@ -2289,7 +2289,7 @@ router_build_fresh_descriptor(routerinfo_t **r,
 extrainfo_
         char *name = family->value;
         const node_t *member;
         if (!strcasecmp(name, options->Nickname))
 -         goto skip; /* Don't list ourself, that's redundant */
 +         continue; /* Don't list ourself, that's redundant */
         else
           member = node_get_by_nickname(name, 1);
         if (!member) {
 @@ -2308,7 +2308,7 @@ router_build_fresh_descriptor(routerinfo_t **r,
 extrainfo_
             smartlist_add_strdup(warned_nonexistent_family, name);
           }
           if (is_legal) {
 -           smartlist_add(ri->declared_family, name);
 +           smartlist_add_strdup(ri->declared_family, name);
             name = NULL;
           }
         } else if (router_digest_is_me(member->identity)) {
 @@ -2323,8 +2323,6 @@ router_build_fresh_descriptor(routerinfo_t **r,
 extrainfo_
           if (smartlist_contains_string(warned_nonexistent_family, name))
             smartlist_string_remove(warned_nonexistent_family, name);
         }
 -    skip:
 -       tor_free(name);
      }

      /* remove duplicates from the list */
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22368#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online


More information about the tor-bugs mailing list