From: Nick Mathewson <nickm@torproject.org>
Date: Sat, 19 Apr 2014 00:30:46 +0000 (-0400)
Subject: scan-build: Avoid crashing on BUG in circuit_get_by_rend_token_and_purpose
X-Git-Tag: tor-0.2.5.4-alpha~14^2~15
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0fd0f5f7a9309fb90a6a4d8bad7d6399a45c7cc1;p=thirdparty%2Ftor.git

scan-build: Avoid crashing on BUG in circuit_get_by_rend_token_and_purpose

If we fail in circuit_get_by_rend_token_and_purpose because the
circuit has no rend_info, don't try to reference fiends from its
rend_info when logging an error.  Bugfix on 8b9a2cb68, which is
going into Tor 0.2.5.4-alpha.
---

diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c
index b71dc3c13a..24cb9fc8d7 100644
--- a/src/or/circuitlist.c
+++ b/src/or/circuitlist.c
@@ -1261,8 +1261,16 @@ circuit_get_by_rend_token_and_purpose(uint8_t purpose, int is_rend_circ,
       circ->base_.marked_for_close)
     return NULL;
 
-  if (!circ->rendinfo ||
-      ! bool_eq(circ->rendinfo->is_rend_circ, is_rend_circ) ||
+  if (!circ->rendinfo) {
+    char *t = tor_strdup(hex_str(token, REND_TOKEN_LEN));
+    log_warn(LD_BUG, "Wanted a circuit with %s:%d, but lookup returned a "
+             "circuit with no rendinfo set.",
+             safe_str(t), is_rend_circ);
+    tor_free(t);
+    return NULL;
+  }
+
+  if (! bool_eq(circ->rendinfo->is_rend_circ, is_rend_circ) ||
       tor_memneq(circ->rendinfo->rend_token, token, REND_TOKEN_LEN)) {
     char *t = tor_strdup(hex_str(token, REND_TOKEN_LEN));
     log_warn(LD_BUG, "Wanted a circuit with %s:%d, but lookup returned %s:%d",