From: Nick Mathewson <nickm@torproject.org>
Date: Wed, 18 Mar 2009 14:35:24 +0000 (+0000)
Subject: Don't double-free successful_uploads.
X-Git-Tag: tor-0.2.1.14-rc~39
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=30ec1d1d50860241c1c4fa1dccd3ff3cde32691a;p=thirdparty%2Ftor.git

Don't double-free successful_uploads.

When we used smartlist_free to free the list of succesful uploads
because we had succeeded in uploading everywhere, we did not actually
set the successful_uploads field to NULL, so later it would get freed
again in rend_service_descriptor_free.  Fix for bug 948; bug
introduced in 0.2.1.6-alpha.

svn:r19073
---

diff --git a/ChangeLog b/ChangeLog
index ad4846629a..7f6315020f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -10,6 +10,8 @@ Changes in version 0.2.1.14-??? - 2009-03-??
     - When starting with a cache over a few days old, do not leak
       memory for the obsolete router descriptors in it.  Bugfix on
       0.2.0.33.
+    - Avoid double-free on list of successfully uploaded hidden
+      service discriptors.  Fix for bug 948.  Bugfix on 0.2.1.6-alpha.
 
 
 Changes in version 0.2.1.13-alpha - 2009-03-09
diff --git a/src/or/rendservice.c b/src/or/rendservice.c
index a30dbc69a5..9d677067cc 100644
--- a/src/or/rendservice.c
+++ b/src/or/rendservice.c
@@ -1676,6 +1676,7 @@ directory_post_to_hs_dir(rend_service_descriptor_t *renddesc,
     if (renddesc->successful_uploads) {
       SMARTLIST_FOREACH(renddesc->successful_uploads, char *, c, tor_free(c););
       smartlist_free(renddesc->successful_uploads);
+      renddesc->successful_uploads = NULL;
     }
     renddesc->all_uploads_performed = 1;
   } else {
@@ -1683,10 +1684,9 @@ directory_post_to_hs_dir(rend_service_descriptor_t *renddesc,
      * descriptor to them again. */
     if (!renddesc->successful_uploads)
       renddesc->successful_uploads = smartlist_create();
-    SMARTLIST_FOREACH(successful_uploads, char *, c, {
+    SMARTLIST_FOREACH(successful_uploads, const char *, c, {
       if (!smartlist_digest_isin(renddesc->successful_uploads, c)) {
-        char *hsdir_id = tor_malloc_zero(DIGEST_LEN);
-        memcpy(hsdir_id, c, DIGEST_LEN);
+        char *hsdir_id = tor_memdup(c, DIGEST_LEN);
         smartlist_add(renddesc->successful_uploads, hsdir_id);
       }
     });