Tor client may crash when using 10 or more bridges,and this phenomenon exists in the latest version (0.2.22-alpha).i tracked the source code and found that in  function  **any_pending_bridge_descriptor_fetches() **in **src/or/circuitbuild.c**, pointer conn->linked_conn may be NULL and the code didn't check it.here's a dirty fix: diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index cfc6b0d..9d428db 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -4748,7 +4748,8 @@ any_pending_bridge_descriptor_fetches(void)          conn->purpose == DIR_PURPOSE_FETCH_SERVERDESC &&          TO_DIR_CONN(conn)->router_purpose == ROUTER_PURPOSE_BRIDGE &&          !conn->marked_for_close && -        conn->linked && !conn->linked_conn->marked_for_close) { +        conn->linked && +        (conn_linked_conn && !conn->linked_conn->marked_for_close) ){        log_debug(LD_DIR, "found one: %s", conn->address);        return 1;      } **Trac**: **Username**: shitlei