mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-12-06 19:41:15 +01:00
George Kadianakis
b6fd78ea30
Commit e80893e51b made tor call
hs_service_intro_circ_has_closed() when we mark for close a circuit.
When we cleanup intro points, we iterate over the descriptor's map of intro
points and we can possibly mark for close a circuit. This was problematic
because we would MAP_DEL_CURRENT() the intro point then free it and finally
mark for close the circuit which would lookup the intro point that we just
free in the map we are iterating over.
This can't be done and leads to a use-after-free because the intro point will
be returned successfully due to the fact that we are still in the loop
iterating. In other words, MAP_DEL_CURRENT() followed by a digest256map_get()
of the same object should never be done in the same loop.
Fixes #24595
Signed-off-by: David Goulet <dgoulet@torproject.org>
Tor protects your privacy on the internet by hiding the connection
between your Internet address and the services you use. We believe Tor
is reasonably secure, but please ensure you read the instructions and
configure it properly.
To build Tor from source:
./configure && make && make install
To build Tor from a just-cloned git repository:
sh autogen.sh && ./configure && make && make install
Home page:
https://www.torproject.org/
Download new versions:
https://www.torproject.org/download/download.html
Documentation, including links to installation and setup instructions:
https://www.torproject.org/docs/documentation.html
Making applications work with Tor:
https://wiki.torproject.org/projects/tor/wiki/doc/TorifyHOWTO
Frequently Asked Questions:
https://www.torproject.org/docs/faq.html
To get started working on Tor development:
See the doc/HACKING directory.
Release timeline:
https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTorReleases