GitLab

Properly behaving clients can't generate a begin cell with streamid 0:

  if (test_stream_id == 0)
    goto again;

but if such a begin cell does arrive at an exit, it will still launch the stream. And since relay_lookup_conn() returns NULL if streamid is 0, so there's no way to address another cell (e.g. a relay end cell) to this stream. It opens but can never be closed.

This is an issue for RELAY_COMMAND_BEGIN, RELAY_COMMAND_BEGIN_DIR, and RELAY_COMMAND_RESOLVE in particular. But we should solve it for all non-control relay cells:

          1 -- RELAY_BEGIN     [forward]
          2 -- RELAY_DATA      [forward or backward]   
          3 -- RELAY_END       [forward or backward]   
          4 -- RELAY_CONNECTED [backward]
         11 -- RELAY_RESOLVE   [forward]
         12 -- RELAY_RESOLVED  [backward]
         13 -- RELAY_BEGIN_DIR [forward]

I think the resolution could be to kill the circuit for breaking protocol?

Bug reported by oftc_must_be_destroyed on oftc.