Free placeholder circid/chan->circuit map entries on exit

In circuitlist_free_all, we free all the circuits, removing them from
the map as we go, but we weren't actually freeing the placeholder
entries that we use to indicate pending DESTROY cells.

Fix for bug 11278; bugfix on the 7912 code that was merged in
0.2.5.1-alpha

1 files changed, 12 insertions, 0 deletions

diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c
index b1efde5ad..5b8225a36 100644
--- a/src/or/circuitlist.c
+++ b/src/or/circuitlist.c
@@ -833,6 +833,18 @@ circuit_free_all(void)
   smartlist_free(circuits_pending_chans);
   circuits_pending_chans = NULL;
 
+  {
+    chan_circid_circuit_map_t **elt, **next, *c;
+    for (elt = HT_START(chan_circid_map, &chan_circid_map);
+         elt;
+         elt = next) {
+      c = *elt;
+      next = HT_NEXT_RMV(chan_circid_map, &chan_circid_map, elt);
+
+      tor_assert(c->circuit == NULL);
+      tor_free(c);
+    }
+  }
   HT_CLEAR(chan_circid_map, &chan_circid_map);
 }