mirror
/
transmission
mirror of https://github.com/transmission/transmission
1
0
Fork 0
Code Issues Releases Wiki Activity

(trunk libT) #2965: "buffer overflow if too many tr= args in a magnet link" -- fixed in trunk for 1.92. thanks to pjz for the patch.

This commit is contained in:
Charles Kerr 2010-02-24 04:23:36 +00:00
parent 91ee0ae3a5
commit 4401dcaa28
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libtransmission/magnet.c
View File

@ -151,10 +151,10 @@ tr_magnetParse( const char * uri )
if( ( keylen==2 ) && !memcmp( key, "dn", 2 ) )
displayName = tr_http_unescape( val, vallen );
if( ( keylen==2 ) && !memcmp( key, "tr", 2 ) )
if( ( keylen==2 ) && !memcmp( key, "tr", 2 ) && ( trCount < MAX_TRACKERS ) )
tr[trCount++] = tr_http_unescape( val, vallen );
if( ( keylen==2 ) && !memcmp( key, "ws", 2 ) )
if( ( keylen==2 ) && !memcmp( key, "ws", 2 ) && ( wsCount < MAX_TRACKERS ) )
ws[wsCount++] = tr_http_unescape( val, vallen );
walk = next != NULL ? next + 1 : NULL;