[tor-bugs] #26072 [Core Tor/Tor]: Malformed connected cell closes connection but code continues

[Tor Bug Tracker & Wiki]

#26072: Malformed connected cell closes connection but code continues
------------------------------+--------------------
     Reporter:  mikeperry     |      Owner:  (none)
         Type:  defect        |     Status:  new
     Priority:  Medium        |  Milestone:
    Component:  Core Tor/Tor  |    Version:
     Severity:  Normal        |   Keywords:
Actual Points:                |  Parent ID:
       Points:                |   Reviewer:
      Sponsor:                |
------------------------------+--------------------
 In connection_edge_process_relay_cell_not_open(), there is a clause that
 closes the connection if the connected cell is malformed. However, it does
 not return from the function. Every other clause where the connection is
 closed does return.

 This looks like a bug. I couldn't immediately find any issues with this,
 though. Perhaps an assert if the connection gets marked twice..

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26072>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online