[tor-bugs] #19175 [Core Tor/Tor]: free(): invalid next size (fast)

[Tor Bug Tracker & Wiki]

#19175: free(): invalid next size (fast)
--------------------------+---------------------
 Reporter:  toralf        |          Owner:
     Type:  defect        |         Status:  new
 Priority:  Medium        |      Milestone:
Component:  Core Tor/Tor  |        Version:
 Severity:  Normal        |     Resolution:
 Keywords:                |  Actual Points:
Parent ID:                |         Points:
 Reviewer:                |        Sponsor:
--------------------------+---------------------

Comment (by nickm):

 {{{
 #3  0x000003d47f848e2f in malloc_printerr (action=3,
     str=0x3d47f942a98 "free(): invalid next size (fast)", ptr=<optimized
 out>,
     ar_ptr=<optimized out>) at malloc.c:5000
 #4  0x000003d47f84969e in _int_free (av=0x3d47fb6fb80 <main_arena>,
     p=<optimized out>, have_lock=0) at malloc.c:3861
 #5  0x00000054d1de0cef in signed_descriptor_free (sd=0x54d409bea0)
     at src/or/routerlist.c:2935
 #6  0x00000054d1de5fd6 in routerlist_remove_old (rl=<optimized out>,
     sd=<optimized out>, idx=<optimized out>, idx at entry=5347)
     at src/or/routerlist.c:3309
 #7  0x00000054d1de64c0 in routerlist_remove_old_cached_routers_with_id (
     now=now at entry=1464188606, cutoff=cutoff at entry=1463756606,
     lo=lo at entry=5346, hi=hi at entry=5348, retain=retain at entry=0x54d32ca4d0)
     at src/or/routerlist.c:3821
 #8  0x00000054d1de8bb5 in routerlist_remove_old_routers ()
     at src/or/routerlist.c:3940
 #9  0x00000054d1d97615 in check_descriptor_callback (now=1464188606,
     options=<optimized out>) at src/or/main.c:1858
 #10 0x00000054d1db1ac3 in periodic_event_dispatch (fd=<optimized out>,
     what=<optimized out>, data=0x54d21a2340 <periodic_events+512>)
     at src/or/periodic.c:52
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19175#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online