Avoid segfault when reading state file from ancient tor

If s_values is null in rep_hist_load_bwhist_state_section, we would
call smartlist_len() on it, and die.

Fixes bug 6801.

diff --git a/changes/bug6801 b/changes/bug6801
new file mode 100644 (file)
index 0000000..ef21acc
--- /dev/null
+++ b/changes/bug6801
@@ -0,0 +1,5 @@
+  o Minor bugfixes:
+    - Avoid segfault when starting up having run with an extremely old
+      version of Tor and parsing its state file. Fixes bug 6801; bugfix on
+      0.2.2.23-alpha.
+

diff --git a/src/or/rephist.c b/src/or/rephist.c
index 720d14cf4509fb6059cfc85708f539ef938cf731..3b0d9dd35f2e34e62bf99717e676cea12cf9916c 100644 (file)
--- a/src/or/rephist.c
+++ b/src/or/rephist.c
@@ -1675,7 +1675,8 @@ rep_hist_load_bwhist_state_section(bw_array_t *b,
 
   uint64_t v, mv;
   int i,ok,ok_m;
-  int have_maxima = (smartlist_len(s_values) == smartlist_len(s_maxima));
+  int have_maxima = s_maxima && s_values &&
+    (smartlist_len(s_values) == smartlist_len(s_maxima));
 
   if (s_values && s_begins >= now - NUM_SECS_BW_SUM_INTERVAL*NUM_TOTALS) {
     start = s_begins - s_interval*(smartlist_len(s_values));