From: Nick Mathewson <nickm@torproject.org>
Date: Sat, 21 Feb 2009 19:07:05 +0000 (+0000)
Subject: Patch from lark: if we get two extend cells for the same circuit id, drop the second... 
X-Git-Tag: tor-0.2.1.13-alpha~17
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=261670b57e8d8e44c6cba8a33c3ed1dfd4a519b5;p=thirdparty%2Ftor.git

Patch from lark: if we get two extend cells for the same circuit id, drop the second.  Previously, we had leaked an extend_info if the target connection was not open when the second arrived.

svn:r18668
---

diff --git a/ChangeLog b/ChangeLog
index 31a87219b3..fa2037c4cd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -30,6 +30,8 @@ Changes in version 0.2.1.13-????? - 2009-02-??
       seconds. Bugfix on 0.1.2.7-alpha; reported by Mike Perry.
     - Drop begin cells to a hidden service if they come from the middle of a
       circuit.  Patch from lark.
+    - When we erroneously receive two EXTEND cells for the same circuit ID
+      on the same connection, drop the second.  Patch from lark.
 
   o Minor features:
     - On Linux, use the prctl call to re-enable core dumps when the user
diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c
index 12db9dd7c5..42da9e6fe0 100644
--- a/src/or/circuitbuild.c
+++ b/src/or/circuitbuild.c
@@ -735,6 +735,11 @@ circuit_extend(cell_t *cell, circuit_t *circ)
            "n_conn already set. Bug/attack. Closing.");
     return -1;
   }
+  if (circ->n_hop) {
+    log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
+           "conn to next hop already launched. Bug/attack. Closing.");
+    return -1;
+  }
 
   if (!server_mode(get_options())) {
     log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,