Commit 03778a0f authored by Mike Perry's avatar Mike Perry
Browse files

Bug 40897: Add more checks to free paths 

Similar double-frees would be caught earlier by these, so long as the pointers
remain nulled out.
parent d02eb450

src/core/or/conflux.c

+2 −0
Original line number Diff line number Diff line
@@ -115,6 +115,8 @@ conflux_leg_t * 
conflux_get_leg(conflux_t *cfx, const circuit_t *circ)

{

  conflux_leg_t *leg_found = NULL;

  tor_assert(cfx);

  tor_assert(cfx->legs);



  // Find the leg that the cell is written on

  CONFLUX_FOR_EACH_LEG_BEGIN(cfx, leg) {

src/core/or/conflux_pool.c

+7 −0
Original line number Diff line number Diff line
@@ -187,6 +187,8 @@ conflux_free_(conflux_t *cfx) 
  if (!cfx) {

    return;

  }

  tor_assert(cfx->legs);

  tor_assert(cfx->ooo_q);



  SMARTLIST_FOREACH_BEGIN(cfx->legs, conflux_leg_t *, leg) {

    SMARTLIST_DEL_CURRENT(cfx->legs, leg);
@@ -260,6 +262,8 @@ unlinked_free(unlinked_circuits_t *unlinked) 
  if (!unlinked) {

    return;

  }

  tor_assert(unlinked->legs);



  /* This cfx is pointing to a linked set. */

  if (!unlinked->is_for_linked_set) {

    conflux_free(unlinked->cfx);
@@ -1611,6 +1615,9 @@ linked_circuit_free(circuit_t *circ, bool is_client) 
{

  tor_assert(circ);

  tor_assert(circ->conflux);

  tor_assert(circ->conflux->legs);

  tor_assert(circ->conflux->ooo_q);



  if (is_client) {

    tor_assert(circ->purpose == CIRCUIT_PURPOSE_CONFLUX_LINKED);

  }