[tor-commits] [tor/master] Avoid double-free on rend_add_service() failure

[nickm at torproject.org]

commit 5dce1829bf8615f78975e1b7d651e97c266b509a
Author: Nick Mathewson <nickm at torproject.org>
Date:   Thu May 28 13:23:09 2015 -0400

    Avoid double-free on rend_add_service() failure
    
    Rend_add_service() frees its argument on failure; no need to free again.
    
    Fixes bug 16228, bugfix on 0.2.7.1-alpha
    
    Found by coverity; this is CID 1301387.
---
 changes/bug16228     |    4 ++++
 src/or/rendservice.c |    3 +--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/changes/bug16228 b/changes/bug16228
new file mode 100644
index 0000000..bf36cf8
--- /dev/null
+++ b/changes/bug16228
@@ -0,0 +1,4 @@
+  o Minor bugfixes (hidden services):
+    - Avoid crashing with a double-free bug when we create an
+      ephemeral hidden service but adding it fails for some reason.
+      Fixes bug 16228; bugfix on 0.2.7.1-alpha.
diff --git a/src/or/rendservice.c b/src/or/rendservice.c
index 0329d70..d27b06d 100644
--- a/src/or/rendservice.c
+++ b/src/or/rendservice.c
@@ -256,7 +256,7 @@ rend_service_free_all(void)
 }
 
 /** Validate <b>service</b> and add it to rend_service_list if possible.
- * Return 0 on success and -1 on failure.
+ * Return 0 on success.  On failure, free <b>service</b> and return -1.
  */
 static int
 rend_add_service(rend_service_t *service)
@@ -868,7 +868,6 @@ rend_service_add_ephemeral(crypto_pk_t *pk,
 
   /* Initialize the service. */
   if (rend_add_service(s)) {
-    rend_service_free(s);
     return RSAE_INTERNAL;
   }
   *service_id_out = tor_strdup(s->service_id);