瀏覽代碼

Proper NULL checking in circuit_list_path_impl()

Another dereference-then-NULL-check sequence. No reports of this bug
triggered in the wild. Fixes bugreport 1256.

Thanks to ekir for discovering and reporting this bug.
Sebastian Hahn 15 年之前
父節點
當前提交
86828e2004
共有 2 個文件被更改,包括 3 次插入1 次删除
  1. 2 0
      ChangeLog
  2. 1 1
      src/or/circuitbuild.c

+ 2 - 0
ChangeLog

@@ -7,6 +7,8 @@ Changes in version 0.2.1.25 - 2010-??-??
     - Fix a dereference-then-NULL-check sequence when publishing
     - Fix a dereference-then-NULL-check sequence when publishing
       descriptors. Bugfix on tor-0.2.1.5-alpha. Discovered by ekir,
       descriptors. Bugfix on tor-0.2.1.5-alpha. Discovered by ekir,
       fixes bug 1255.
       fixes bug 1255.
+    - Fix another dereference-then-NULL-check sequence. Bugfix on
+      0.2.1.14-rc. Discovered by ekir, fixes bug 1256.
 
 
 Changes in version 0.2.1.24 - 2010-02-21
 Changes in version 0.2.1.24 - 2010-02-21
   Tor 0.2.1.24 makes Tor work again on the latest OS X -- this time
   Tor 0.2.1.24 makes Tor work again on the latest OS X -- this time

+ 1 - 1
src/or/circuitbuild.c

@@ -137,11 +137,11 @@ circuit_list_path_impl(origin_circuit_t *circ, int verbose, int verbose_names)
     const char *id;
     const char *id;
     if (!hop)
     if (!hop)
       break;
       break;
-    id = hop->extend_info->identity_digest;
     if (!verbose && hop->state != CPATH_STATE_OPEN)
     if (!verbose && hop->state != CPATH_STATE_OPEN)
       break;
       break;
     if (!hop->extend_info)
     if (!hop->extend_info)
       break;
       break;
+    id = hop->extend_info->identity_digest;
     if (verbose_names) {
     if (verbose_names) {
       elt = tor_malloc(MAX_VERBOSE_NICKNAME_LEN+1);
       elt = tor_malloc(MAX_VERBOSE_NICKNAME_LEN+1);
       if ((ri = router_get_by_digest(id))) {
       if ((ri = router_get_by_digest(id))) {