torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Move the original log_info call out of the core of buf_shrink_freelists.

Browse Source 
Sending a log message to a control port can cause Tor to allocate a buffer,
thereby changing the length of the freelist behind buf_shrink_freelists's back,
thereby causing an assertion to fail.

Fixes bug #1125.
This commit is contained in:
Robert Ransom
2010-11-12 03:04:07 -08:00
parent 0a38358210
commit 81affe1949
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/or/buffers.c
+4 -3
View File
@@ -259,12 +259,10 @@ buf_shrink_freelists(int free_all)
(freelists[i].lowest_length - slack);
int n_to_skip = freelists[i].cur_length - n_to_free;
int orig_n_to_free = n_to_free, n_freed=0;
int orig_n_to_skip = n_to_skip;
int new_length = n_to_skip;
chunk_t **chp = &freelists[i].head;
chunk_t *chunk;
log_info(LD_MM, "Cleaning freelist for %d-byte chunks: keeping %d, "
"dropping %d.",
(int)freelists[i].alloc_size, n_to_skip, n_to_free);
while (n_to_skip) {
tor_assert((*chp)->next);
chp = &(*chp)->next;
@@ -291,6 +289,9 @@ buf_shrink_freelists(int free_all)
}
// tor_assert(!n_to_free);
freelists[i].cur_length = new_length;
log_info(LD_MM, "Cleaned freelist for %d-byte chunks: kept %d, "
"dropped %d.",
(int)freelists[i].alloc_size, orig_n_to_skip, orig_n_to_free);
}
freelists[i].lowest_length = freelists[i].cur_length;
assert_freelist_ok(&freelists[i]);