[or-cvs] r9928: Fix second part of bug 411 (which was actually a separate bu (in tor/trunk: . src/or)

[nickm at seul.org]

Author: nickm
Date: 2007-04-09 16:09:26 -0400 (Mon, 09 Apr 2007)
New Revision: 9928

Modified:
   tor/trunk/
   tor/trunk/src/or/circuitlist.c
Log:
 r12317 at catbus:  nickm | 2007-04-09 15:50:51 -0400
 Fix second part of bug 411 (which was actually a separate bug): it isnt safe to clear a cell queue while the circuit is active.



Property changes on: tor/trunk
___________________________________________________________________
 svk:merge ticket from /tor/trunk [r12317] on 8246c3cf-6607-4228-993b-4d95d33730f1

Modified: tor/trunk/src/or/circuitlist.c
===================================================================
--- tor/trunk/src/or/circuitlist.c	2007-04-09 13:50:21 UTC (rev 9927)
+++ tor/trunk/src/or/circuitlist.c	2007-04-09 20:09:26 UTC (rev 9928)
@@ -398,19 +398,23 @@
       other->rend_splice = NULL;
     }
 
-    cell_queue_clear(&ocirc->p_conn_cells);
-
     tor_free(circ->onionskin);
 
     /* remove from map. */
     circuit_set_p_circid_orconn(ocirc, 0, NULL);
+
+    /* Clear cell queue _after_ removing it from the map.  Otherwise our
+     * "active" checks will be violated. */
+    cell_queue_clear(&ocirc->p_conn_cells);
   }
 
-  cell_queue_clear(&circ->n_conn_cells);
-
   /* Remove from map. */
   circuit_set_n_circid_orconn(circ, 0, NULL);
 
+  /* Clear cell queue _after_ removing it from the map.  Otherwise our
+   * "active" checks will be violated. */
+  cell_queue_clear(&circ->n_conn_cells);
+
   memset(circ, 0xAA, sizeof(circuit_t)); /* poison memory */
   tor_free(mem);
 }