Fix addrman crashes

A function returned the element to remove from a bucket, instead of its
position in that bucket. This function was only called when a tried
bucket overflowed, which only happens after many outgoing connections
have been made.

Closes: #1065, #1156

diff --git a/src/addrman.cpp b/src/addrman.cpp
index c1a0df6..10d005a 100644 (file)
--- a/src/addrman.cpp
+++ b/src/addrman.cpp
@@ -130,6 +130,7 @@ int CAddrMan::SelectTried(int nKBucket)
     // random shuffle the first few elements (using the entire list)
     // find the least recently tried among them
     int64 nOldest = -1;
+    int nOldestPos = -1;
     for (unsigned int i = 0; i < ADDRMAN_TRIED_ENTRIES_INSPECT_ON_EVICT && i < vTried.size(); i++)
     {
         int nPos = GetRandInt(vTried.size() - i) + i;
@@ -137,11 +138,13 @@ int CAddrMan::SelectTried(int nKBucket)
         vTried[nPos] = vTried[i];
         vTried[i] = nTemp;
         assert(nOldest == -1 || mapInfo.count(nTemp) == 1);
-        if (nOldest == -1 || mapInfo[nTemp].nLastSuccess < mapInfo[nOldest].nLastSuccess)
+        if (nOldest == -1 || mapInfo[nTemp].nLastSuccess < mapInfo[nOldest].nLastSuccess) {
            nOldest = nTemp;
+           nOldestPos = nPos;
+        }
     }
 
-    return nOldest;
+    return nOldestPos;
 }
 
 int CAddrMan::ShrinkNew(int nUBucket)