[tor-commits] [tor/master] Merge branch 'maint-0.3.2'

[nickm at torproject.org]

commit b8a3602b2a7114f2027d4a3af27520b109762efd
Merge: bcc96c77d 84adb9fcc
Author: Nick Mathewson <nickm at torproject.org>
Date:   Thu Dec 21 10:54:05 2017 -0500

    Merge branch 'maint-0.3.2'

 changes/bug24666           |  7 +++++
 src/or/circuitmux.c        | 34 ++++++--------------
 src/or/circuitmux.h        |  2 +-
 src/or/or.h                | 15 +++++++++
 src/or/relay.c             | 78 ++++++++++++++++++++++++++++++++++++++++++++--
 src/or/relay.h             |  8 +++++
 src/test/test_circuitmux.c | 12 +++----
 7 files changed, 122 insertions(+), 34 deletions(-)

diff --cc src/or/relay.c
index f6528c6ea,66e10567c..8ef66f03c
--- a/src/or/relay.c
+++ b/src/or/relay.c
@@@ -2743,16 -2810,18 +2810,23 @@@ channel_flush_from_first_active_circuit
    while (n_flushed < max) {
      circ = circuitmux_get_first_active_circuit(cmux, &destroy_queue);
      if (destroy_queue) {
+       destroy_cell_t *dcell;
        /* this code is duplicated from some of the logic below. Ugly! XXXX */
+       /* If we are given a destroy_queue here, then it is required to be
+        * nonempty... */
        tor_assert(destroy_queue->n > 0);
-       cell = cell_queue_pop(destroy_queue);
+       dcell = destroy_cell_queue_pop(destroy_queue);
+       /* ...and pop() will always yield a cell from a nonempty queue. */
+       tor_assert(dcell);
+       /* frees dcell */
+       cell = destroy_cell_to_packed_cell(dcell, chan->wide_circ_ids);
 -      /* frees cell */
 -      channel_write_packed_cell(chan, cell);
 +      /* Send the DESTROY cell. It is very unlikely that this fails but just
 +       * in case, get rid of the channel. */
 +      if (channel_write_packed_cell(chan, cell) < 0) {
 +        /* The cell has been freed. */
 +        channel_mark_for_close(chan);
 +        continue;
 +      }
        /* Update the cmux destroy counter */
        circuitmux_notify_xmit_destroy(cmux);
        cell = NULL;