[tor-bugs] #17401 [Tor]: use-after-free in validate_intro_point_failure

[Tor Bug Tracker & Wiki]

#17401: use-after-free in validate_intro_point_failure
---------------------------+--------------------------------
     Reporter:  nickm      |      Owner:
         Type:  defect     |     Status:  new
     Priority:  Very High  |  Milestone:  Tor: 0.2.7.x-final
    Component:  Tor        |    Version:
     Severity:  Major      |   Keywords:
Actual Points:             |  Parent ID:
       Points:             |    Sponsor:
---------------------------+--------------------------------
 In validate_intro_point_failure(), we look at `identity` after freeing
 `intro`.  But `identity` is a reference into `intro`, so we shouldn't free
 `intro` till we're done with it.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17401>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online