[tor-commits] [tor/master] Clean up service-side descriptor cache and fix potential double-free.

[nickm at torproject.org]

commit 0bd68bf98617607f5ca0f98e4d67bf66c6b5b210
Author: Donncha O'Cearbhaill <donncha at donncha.is>
Date:   Mon Aug 3 17:37:09 2015 +0200

    Clean up service-side descriptor cache and fix potential double-free.
    
    Entries in the service-side descriptor cache are now cleaned when
    rend_cache_free_all() is called. The call to tor_free(intro_content)
    in rend_cache_store_v2_desc_as_service() is moved to prevent a
    potential double-free when a service has a descriptor with a newer
    timestamp already in it's service-side descriptor cache.
---
 src/or/rendcache.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/or/rendcache.c b/src/or/rendcache.c
index 0abfeb5..7617e9d 100644
--- a/src/or/rendcache.c
+++ b/src/or/rendcache.c
@@ -222,9 +222,11 @@ rend_cache_free_all(void)
 {
   strmap_free(rend_cache, rend_cache_entry_free_);
   digestmap_free(rend_cache_v2_dir, rend_cache_entry_free_);
+  strmap_free(rend_cache_service, rend_cache_entry_free_);
   strmap_free(rend_cache_failure, rend_cache_failure_entry_free_);
   rend_cache = NULL;
   rend_cache_v2_dir = NULL;
+  rend_cache_service = NULL;
   rend_cache_failure = NULL;
   rend_cache_total_allocation = 0;
 }
@@ -715,8 +717,6 @@ rend_cache_store_v2_desc_as_service(const char *desc)
     log_warn(LD_REND, "Couldn't compute service ID.");
     goto err;
   }
-  /* We don't care about the introduction points. */
-  tor_free(intro_content);
 
   /* Do we already have a newer descriptor? Allow new descriptors with a
      rounded timestamp equal to or newer than the current descriptor */
@@ -726,6 +726,8 @@ rend_cache_store_v2_desc_as_service(const char *desc)
              "service ID %s.", safe_str_client(service_id));
     goto okay;
   }
+  /* We don't care about the introduction points. */
+  tor_free(intro_content);
   if (!e) {
     e = tor_malloc_zero(sizeof(rend_cache_entry_t));
     strmap_set_lc(rend_cache_service, service_id, e);