fix a bug that's been lurking since 27 may 03 (!)

when passing back a destroy cell, we would use the wrong circ id.
how the heck did this work?

svn:r1710

diff --git a/src/or/circuit.c b/src/or/circuit.c
index b65bc3270c0c18d67287b4d1e96e4c6581b9c240..3964ac1b695f43c8e384cdb6229f8bbead5dc07e 100644 (file)
--- a/src/or/circuit.c
+++ b/src/or/circuit.c
@@ -1015,7 +1015,7 @@ int _circuit_mark_for_close(circuit_t *circ) {
     connection_edge_destroy(circ->n_circ_id, conn);
   }
   if(circ->p_conn)
-    connection_send_destroy(circ->n_circ_id, circ->p_conn);
+    connection_send_destroy(circ->p_circ_id, circ->p_conn);
   for(conn=circ->p_streams; conn; conn=conn->next_stream) {
     connection_edge_destroy(circ->p_circ_id, conn);
   }