Handle TRUNCATE correctly if our next channel isn't done yet.

Patch from 'cypherpunks'. Fixes bug #7947. Bugfix on 0.0.7.1.

diff --git a/changes/bug7947 b/changes/bug7947
new file mode 100644 (file)
index 0000000..6200ba2
--- /dev/null
+++ b/changes/bug7947
@@ -0,0 +1,4 @@
+  o Minor bugfixes:
+    - Fix the handling of a TRUNCATE cell when it arrives while the circuit
+      extension is in progress. Fixes bug 7947; bugfix on 0.0.7.1.
+

diff --git a/src/or/relay.c b/src/or/relay.c
index 9ff9e1e1f4dcba9a0789d726c10e61e8f525b9ef..8e80d14a87dfc521c88524e90257bacf776c80c9 100644 (file)
--- a/src/or/relay.c
+++ b/src/or/relay.c
@@ -1398,6 +1398,14 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ,
                "'truncate' unsupported at origin. Dropping.");
         return 0;
       }
+      if (circ->n_hop) {
+        if (circ->n_chan)
+          log_warn(LD_BUG, "n_chan and n_hop set on the same circuit!");
+        extend_info_free(circ->n_hop);
+        circ->n_hop = NULL;
+        tor_free(circ->n_chan_create_cell);
+        circuit_set_state(circ, CIRCUIT_STATE_OPEN);
+      }
       if (circ->n_chan) {
         uint8_t trunc_reason = get_uint8(cell->payload + RELAY_HEADER_SIZE);
         circuit_clear_cell_queue(circ, circ->n_chan);