[tor-commits] [tor/master] hs-v3: Don't crash after SIGHUP in Onionbalance backend mode.

[dgoulet at torproject.org]

commit 0667a5af8df8f372f6482254ca24c66268ed02f8
Author: George Kadianakis <desnacked at riseup.net>
Date:   Mon Mar 30 23:17:39 2020 +0300

    hs-v3: Don't crash after SIGHUP in Onionbalance backend mode.
    
    The ob_subcreds array was not copied after SIGHUP, and that left the
    post-SIGHUP service with a NULL ob_subcreds pointer (until the next descriptor
    gets build where we regenerate ob_subcreds in hs_ob_refresh_keys()).
    
    Fixes bug #33762; not in any released tor version.
---
 src/feature/hs/hs_service.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/feature/hs/hs_service.c b/src/feature/hs/hs_service.c
index 3a2beb766..367f8ca2b 100644
--- a/src/feature/hs/hs_service.c
+++ b/src/feature/hs/hs_service.c
@@ -890,10 +890,18 @@ move_hs_state(hs_service_t *src_service, hs_service_t *dst_service)
   if (dst->replay_cache_rend_cookie != NULL) {
     replaycache_free(dst->replay_cache_rend_cookie);
   }
+
   dst->replay_cache_rend_cookie = src->replay_cache_rend_cookie;
+  src->replay_cache_rend_cookie = NULL; /* steal pointer reference */
+
   dst->next_rotation_time = src->next_rotation_time;
 
-  src->replay_cache_rend_cookie = NULL; /* steal pointer reference */
+  if (src_service->ob_subcreds) {
+    dst_service->ob_subcreds = src_service->ob_subcreds;
+    dst_service->n_ob_subcreds =  src_service->n_ob_subcreds;
+
+    src_service->ob_subcreds = NULL; /* steal pointer reference */
+  }
 }
 
 /** Register services that are in the staging list. Once this function returns,