r12553@catbus: nickm | 2007-04-30 01:32:54 -0400

 Backport candidate:  Add asserts to dirserv_remove_invalid, and fix a bug in dirserv_remove_invalid that could mess with pointers in a freed routerinfo right after it was freed.

svn:r10052

diff --git a/ChangeLog b/ChangeLog
index 6ff3ca1bb145e7e78ed19e75667c2c8d5a78d7fd..80da7f5e73fa336883eb3894faea2d0224e7ee3d 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -86,6 +86,9 @@ Changes in version 0.2.0.1-alpha - 2007-??-??
       we restart.
     - Correctly enforce that elements of directory objects do not appear
       more often than they are allowed to appear.
+    - Fix a bug in dirserv_remove_invalid() that would cause authorities to
+      corrupt memory under some really unlikely scenarios.
+    - Add even more asserts to hunt down bug 417.
 
   o Minor bugfixes (controller), reported by daejees:
     - Make 'getinfo fingerprint' return a 551 error if we're not a

diff --git a/src/or/dirserv.c b/src/or/dirserv.c
index 415810ebfd85398268f2350391e4b1f36c48a6a4..1effd10bffb1e9aeefcdb8bdfb19e149e437035a 100644 (file)
--- a/src/or/dirserv.c
+++ b/src/or/dirserv.c
@@ -621,6 +621,8 @@ directory_remove_invalid(void)
   int changed = 0;
   routerlist_t *rl = router_get_routerlist();
 
+  routerlist_assert_ok(rl);
+
   for (i = 0; i < smartlist_len(rl->routers); ++i) {
     const char *msg;
     routerinfo_t *ent = smartlist_get(rl->routers, i);
@@ -630,6 +632,7 @@ directory_remove_invalid(void)
                ent->nickname, msg?msg:"");
       routerlist_remove(rl, ent, i--, 0);
       changed = 1;
+      continue;
     }
     if (bool_neq((r & FP_NAMED), ent->is_named)) {
       log_info(LD_DIRSERV,
@@ -653,6 +656,8 @@ directory_remove_invalid(void)
   }
   if (changed)
     directory_set_dirty();
+
+  routerlist_assert_ok(rl);
 }
 
 /** Write a list of unregistered descriptors into a newly allocated

diff --git a/src/or/routerlist.c b/src/or/routerlist.c
index 0dfa4dbcaf226d845f9f149f4c817b18074d58cf..c211d7c1c6c090c6a2cd76674bb8465edcfdc2ef 100644 (file)
--- a/src/or/routerlist.c
+++ b/src/or/routerlist.c
@@ -4674,7 +4674,7 @@ routerlist_assert_ok(routerlist_t *rl)
   digestmap_iter_t *iter;
   routerinfo_t *r2;
   signed_descriptor_t *sd2;
-  if (!routerlist)
+  if (!rl);
     return;
   SMARTLIST_FOREACH(rl->routers, routerinfo_t *, r,
   {