Handle TRUNCATE correctly if our next channel isn't done yet.

Patch from 'cypherpunks'. Fixes bug #7947. Bugfix on 0.0.7.1.

1 files changed, 8 insertions, 0 deletions

diff --git a/src/or/relay.c b/src/or/relay.c
index 9ff9e1e1f..8e80d14a8 100644
--- a/src/or/relay.c
+++ b/src/or/relay.c
@@ -1398,6 +1398,14 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ,
                "'truncate' unsupported at origin. Dropping.");
         return 0;
       }
+      if (circ->n_hop) {
+        if (circ->n_chan)
+          log_warn(LD_BUG, "n_chan and n_hop set on the same circuit!");
+        extend_info_free(circ->n_hop);
+        circ->n_hop = NULL;
+        tor_free(circ->n_chan_create_cell);
+        circuit_set_state(circ, CIRCUIT_STATE_OPEN);
+      }
       if (circ->n_chan) {
         uint8_t trunc_reason = get_uint8(cell->payload + RELAY_HEADER_SIZE);
         circuit_clear_cell_queue(circ, circ->n_chan);