瀏覽代碼

r12317@catbus: nickm | 2007-04-09 15:50:51 -0400
Fix second part of bug 411 (which was actually a separate bug): it isnt safe to clear a cell queue while the circuit is active.


svn:r9928

Nick Mathewson 18 年之前
父節點
當前提交
eb95ff9ba9
共有 1 個文件被更改,包括 8 次插入4 次删除
  1. 8 4
      src/or/circuitlist.c

+ 8 - 4
src/or/circuitlist.c

@@ -398,19 +398,23 @@ circuit_free(circuit_t *circ)
       other->rend_splice = NULL;
     }
 
-    cell_queue_clear(&ocirc->p_conn_cells);
-
     tor_free(circ->onionskin);
 
     /* remove from map. */
     circuit_set_p_circid_orconn(ocirc, 0, NULL);
-  }
 
-  cell_queue_clear(&circ->n_conn_cells);
+    /* Clear cell queue _after_ removing it from the map.  Otherwise our
+     * "active" checks will be violated. */
+    cell_queue_clear(&ocirc->p_conn_cells);
+  }
 
   /* Remove from map. */
   circuit_set_n_circid_orconn(circ, 0, NULL);
 
+  /* Clear cell queue _after_ removing it from the map.  Otherwise our
+   * "active" checks will be violated. */
+  cell_queue_clear(&circ->n_conn_cells);
+
   memset(circ, 0xAA, sizeof(circuit_t)); /* poison memory */
   tor_free(mem);
 }