From: Sebastian Hahn <sebastian@torproject.org>
Date: Sat, 29 Aug 2015 15:00:51 +0000 (+0200)
Subject: properly delete current channel in channel_free_list
X-Git-Tag: tor-0.2.7.3-rc~78^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bbb73eaf31d3df5cde70ac4ca7145ffca053d53e;p=thirdparty%2Ftor.git

properly delete current channel in channel_free_list

channel_unregister() removes channels from the current smartlist while
we're in a SMORTLIST_FOREACH loop. This only works by accident.
---

diff --git a/changes/bug16924 b/changes/bug16924
new file mode 100644
index 0000000000..a1bc96e54d
--- /dev/null
+++ b/changes/bug16924
@@ -0,0 +1,6 @@
+  o Minor bugfixes:
+    - When calling channel_free_list(), avoid calling smartlist_remove()
+      while inside a FOREACH loop. This partially reverts commit
+      17356fe7fd96af where the correct SMARTLIST_DEL_CURRENT was
+      removed.  Fixes bug 16929; bugfix on 0.2.4.4-alpha.
+
diff --git a/src/or/channel.c b/src/or/channel.c
index af095026e4..21522a5303 100644
--- a/src/or/channel.c
+++ b/src/or/channel.c
@@ -3069,6 +3069,7 @@ channel_free_list(smartlist_t *channels, int mark_for_close)
     if (curr->cmux) {
       circuitmux_detach_all_circuits(curr->cmux, NULL);
     }
+    SMARTLIST_DEL_CURRENT(channels, curr);
     channel_unregister(curr);
     if (mark_for_close) {
       if (!CHANNEL_CONDEMNED(curr)) {