Merge remote-tracking branch 'public/bug7816_024'

changes/bug7816.024

@@ -0,0 +1,8 @@
+  o Minor bugfixes:
+    - Avoid leaking IPv6 policy content if we fail to format it into
+      a router descriptor. Spotted by Coverity. Fixes part of 7816;
+      bugfix on 0.2.4.7-alpha.
+
+    - Avoid leaking memory if we fail to compute a consensus signature
+      or we generated a consensus we couldn't parse. Spotted by Coverity.
+      Fixes part of 7816; bugfix on 0.2.0.5-alpha.

src/or/dirvote.c

@@ -2144,7 +2144,7 @@ networkstatus_compute_consensus(smartlist_t *votes,
                                          digest, digest_len,
                                          legacy_signing_key)) {
         log_warn(LD_BUG, "Couldn't sign consensus networkstatus.");
-        return NULL; /* This leaks, but it should never happen. */
+        goto done;
       }
       smartlist_add(chunks, tor_strdup(sigbuf));
     }
@@ -2152,13 +2152,6 @@ networkstatus_compute_consensus(smartlist_t *votes,
 
   result = smartlist_join_strings(chunks, "", 0, NULL);
 
-  tor_free(client_versions);
-  tor_free(server_versions);
-  SMARTLIST_FOREACH(flags, char *, cp, tor_free(cp));
-  smartlist_free(flags);
-  SMARTLIST_FOREACH(chunks, char *, cp, tor_free(cp));
-  smartlist_free(chunks);
-
   {
     networkstatus_t *c;
     if (!(c = networkstatus_parse_vote_from_string(result, NULL,
@@ -2166,7 +2159,7 @@ networkstatus_compute_consensus(smartlist_t *votes,
       log_err(LD_BUG, "Generated a networkstatus consensus we couldn't "
               "parse.");
       tor_free(result);
-      return NULL;
+      goto done;
     }
     // Verify balancing parameters
     if (consensus_method >= MIN_METHOD_FOR_BW_WEIGHTS && added_weights) {
@@ -2175,6 +2168,15 @@ networkstatus_compute_consensus(smartlist_t *votes,
     networkstatus_vote_free(c);
   }
 
+ done:
+
+  tor_free(client_versions);
+  tor_free(server_versions);
+  SMARTLIST_FOREACH(flags, char *, cp, tor_free(cp));
+  smartlist_free(flags);
+  SMARTLIST_FOREACH(chunks, char *, cp, tor_free(cp));
+  smartlist_free(chunks);
+
   return result;
 }
 

src/or/router.c

@@ -2399,6 +2399,7 @@ router_dump_router_to_string(char *s, size_t maxlen, routerinfo_t *router,
                             "ipv6-policy %s\n", p6);
       if (result<0) {
         log_warn(LD_BUG,"Descriptor printf of policy ran out of room");
+        tor_free(p6);
         return -1;
       }
       written += result;