[tor-bugs] #2629 [Tor Client]: tor client crashed when using bridges

[Tor Bug Tracker & Wiki]

#2629: tor client crashed when using bridges
------------------------+---------------------------------------------------
 Reporter:  shitlei     |          Owner:                    
     Type:  defect      |         Status:  new               
 Priority:  normal      |      Milestone:  Tor: 0.2.2.x-final
Component:  Tor Client  |        Version:                    
 Keywords:              |         Parent:                    
   Points:              |   Actualpoints:                    
------------------------+---------------------------------------------------
 Tor client may crash when using 10 or more bridges,and this phenomenon
 exists in the latest version (0.2.22-alpha).i tracked the source code and
 found that in  function  '''any_pending_bridge_descriptor_fetches() '''in
 '''src/or/circuitbuild.c''', pointer conn->linked_conn may be NULL and the
 code didn't check it.here's a dirty fix:

 diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c
 index cfc6b0d..9d428db 100644
 --- a/src/or/circuitbuild.c
 +++ b/src/or/circuitbuild.c
 @@ -4748,7 +4748,8 @@ any_pending_bridge_descriptor_fetches(void)
          conn->purpose == DIR_PURPOSE_FETCH_SERVERDESC &&
          TO_DIR_CONN(conn)->router_purpose == ROUTER_PURPOSE_BRIDGE &&
          !conn->marked_for_close &&
 -        conn->linked && !conn->linked_conn->marked_for_close) {
 +        conn->linked &&
 +        (conn_linked_conn && !conn->linked_conn->marked_for_close) ){
        log_debug(LD_DIR, "found one: %s", conn->address);
        return 1;
      }

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2629>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online