Commit 71ee53fe authored by Nick Mathewson's avatar Nick Mathewson 🤹
Browse files

Do not leave empty, invalid chunks in buffers during buf_pullup 

This fixes an assertion failure bug in 15083; bugfix on 0.2.0.10-alpha.

Patch from 'cypherpunks'
parent c3f8f5ab

changes/bug15083

0 → 100644
+6 −0
Original line number Diff line number Diff line 
  o Major bugfixes (relay, stability):

    - Fix a bug that could lead to a relay crashing with an assertion

      failure if a buffer of exactly the wrong layout was passed

      to buf_pullup() at exactly the wrong time. Fixes bug 15083;

      bugfix on 0.2.0.10-alpha. Patch from 'cypherpunks'.

src/or/buffers.c

+1 −1
Original line number Diff line number Diff line
@@ -426,7 +426,7 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate) 
    size_t n = bytes - dest->datalen;

    src = dest->next;

    tor_assert(src);

    if (n > src->datalen) {

    if (n >= src->datalen) {

      memcpy(CHUNK_WRITE_PTR(dest), src->data, src->datalen);

      dest->datalen += src->datalen;

      dest->next = src->next;