[tor-bugs] #14031 [Tor]: use after freed

[Tor Bug Tracker & Wiki]

#14031: use after freed
----------------------------+--------------------------------
     Reporter:  MegaManSec  |      Owner:
         Type:  defect      |     Status:  needs_information
     Priority:  minor       |  Milestone:  Tor: 0.2.6.x-final
    Component:  Tor         |    Version:
   Resolution:              |   Keywords:  tor-tests
Actual Points:              |  Parent ID:
       Points:              |
----------------------------+--------------------------------
Changes (by nickm):

 * keywords:   => tor-tests
 * status:  new => needs_information
 * component:  - Select a component => Tor
 * milestone:   => Tor: 0.2.6.x-final


Comment:

 Did you spot this with some static analysis tool?  And does the latest Tor
 master branch have the same problem?  I think I fixed this with
 808e2b856bd77fa9b431272a6f37596655fd5945.

 (Note that the tt_ptr_op call uses the address of cell, but not the cell
 itself).

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/14031#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online