r12434@catbus: nickm | 2007-04-19 11:23:35 -0400

 When advancing a string pointer, make sure we do not later free the altered pointer.  Fixes bug 416, introduced in r9971.

svn:r9990

diff --git a/src/or/directory.c b/src/or/directory.c
index e76108f9b2c91338d2c66a44a69a5f56e7d1f8f6..2c1261bd3283c3c88179316fe05f9a566fdc3c1e 100644 (file)
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -1685,6 +1685,7 @@ directory_handle_command_get(dir_connection_t *conn, const char *headers,
 
   if (!strcmpstart(url,"/tor/server/") ||
       !strcmpstart(url,"/tor/extra/")) {
+    char *url_mem = url;
     size_t url_len = strlen(url);
     int deflated = !strcmp(url+url_len-2, ".z");
     int res;
@@ -1724,7 +1725,7 @@ directory_handle_command_get(dir_connection_t *conn, const char *headers,
     else
       conn->dir_spool_src =
         is_extra ? DIR_SPOOL_EXTRA_BY_FP : DIR_SPOOL_SERVER_BY_FP;
-    tor_free(url);
+    tor_free(url_mem);
     if (res < 0)
       write_http_status_line(conn, 404, msg);
     else {