When there are no dir_server_ts to choose, don't crash

It's important not to call choose_array_element_by_weight and then
pass its return value unchecked to smartlist_get : it is allowed to
return -1.

Fixes bug 7756; bugfix on 4e3d07a6 (not in any released Tor)

diff --git a/src/or/routerlist.c b/src/or/routerlist.c
index 972d4513dd26a17a036a2c21e33132d9ffbeb3f7..898b9b5b982ecbf0cb91d2c8be876f4a650c9f78 100644 (file)
--- a/src/or/routerlist.c
+++ b/src/or/routerlist.c
@@ -1270,7 +1270,7 @@ dirserver_choose_by_weight(const smartlist_t *servers, double authority_weight)
   scale_array_elements_to_u64(weights, n, NULL);
   i = choose_array_element_by_weight(weights, n);
   tor_free(weights);
-  return smartlist_get(servers, i);
+  return (i < 0) ? NULL : smartlist_get(servers, i);
 }
 
 /** Choose randomly from among the dir_server_ts in sourcelist that