Opened 7 years ago

Closed 7 years ago

#7814 closed defect (fixed)

Segfault with exit on 0.2.4.7-alpha

Reported by: nickm Owned by:
Priority: High Milestone: Tor: 0.2.4.x-final
Component: Core Tor/Tor Version: Tor: 0.2.4.7-alpha
Severity: Keywords: tor-relay
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Andrea encountered this while testing #7743

 #0  0x0000000000539321 in tor_strlower (s=0x0) at src/common/util.c:517
 #1  0x00000000004d56c4 in connection_exit_begin_conn (cell=0x7fffffffde30,
 circ=0x1bec960)
     at src/or/connection_edge.c:2482
 #2  0x0000000000429143 in connection_edge_process_relay_cell
 (cell=0x7fffffffde30, circ=0x1bec960, conn=0x0,
     layer_hint=0x0) at src/or/relay.c:1190
 #3  0x0000000000425e66 in circuit_receive_relay_cell (cell=0x7fffffffde30,
 circ=0x1bec960,
     cell_direction=CELL_DIRECTION_OUT) at src/or/relay.c:193
 #4  0x00000000004b00a9 in command_process_relay_cell (cell=0x7fffffffde30,
 chan=0x1d9c0e0) at src/or/command.c:407
 #5  0x00000000004af32d in command_process_cell (chan=0x1d9c0e0,
 cell=0x7fffffffde30) at src/or/command.c:147
 #6  0x0000000000485fac in channel_queue_cell (chan=0x1d9c0e0,
 cell=0x7fffffffde30) at src/or/channel.c:2516
 #7  0x000000000048cb48 in channel_tls_handle_cell (cell=0x7fffffffde30,
 conn=0x22fc5e0) at src/or/channeltls.c:921
 #8  0x00000000004db608 in connection_or_process_cells_from_inbuf
 (conn=0x22fc5e0) at src/or/connection_or.c:1937
 #9  0x00000000004d80a6 in connection_or_process_inbuf (conn=0x22fc5e0) at
 src/or/connection_or.c:461
 #10 0x00000000004cbba9 in connection_process_inbuf (conn=0x22fc5e0,
 package_partial=1) at src/or/connection.c:3954
 #11 0x00000000004c95c9 in connection_handle_read_impl (conn=0x22fc5e0) at
 src/or/connection.c:2819
 #12 0x00000000004c96f4 in connection_handle_read (conn=0x22fc5e0) at
 src/or/connection.c:2860
 #13 0x000000000040a26f in conn_read_callback (fd=22, event=2,
 _conn=0x22fc5e0) at src/or/main.c:722
 #14 0x00007ffff772f930 in event_process_active (base=0x7e4c70,
 flags=<value optimized out>) at event.c:395
 #15 event_base_loop (base=0x7e4c70, flags=<value optimized out>) at
 event.c:547
 #16 0x000000000040cc77 in do_main_loop () at src/or/main.c:1989
 #17 0x000000000040e237 in tor_main (argc=3, argv=0x7fffffffe658) at
 src/or/main.c:2701
 #18 0x0000000000408844 in main (argc=3, argv=0x7fffffffe658) at
 src/or/tor_main.c:30

Child Tickets

Change History (3)

comment:1 Changed 7 years ago by nickm

Version: Tor: 0.2.4.7-alpha

Please review branch "bug7814" in my public repository.

comment:2 Changed 7 years ago by nickm

Status: newneeds_review

I've verified that every other relay_send_end_cell_from_edge() is followed (immediately or soon) by a return.

comment:3 Changed 7 years ago by nickm

Resolution: fixed
Status: needs_reviewclosed

Merged to master.

Note: See TracTickets for help on using tickets.