mirror/transmission
1
0
Fork 0
mirror of https://github.com/transmission/transmission synced 2024-12-24 08:43:27 +00:00
Code Issues Releases Wiki Activity

(trunk libT) #2965: "buffer overflow if too many tr= args in a magnet link" -- fixed in trunk for 1.92. thanks to pjz for the patch.

Browse source
This commit is contained in:
Charles Kerr 2010-02-24 04:23:36 +00:00
parent 91ee0ae3a5
commit 4401dcaa28
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
libtransmission/magnet.c
View file

@ -151,10 +151,10 @@ tr_magnetParse( const char * uri )
if( ( keylen==2 ) && !memcmp( key, "dn", 2 ) ) if( ( keylen==2 ) && !memcmp( key, "dn", 2 ) )
displayName = tr_http_unescape( val, vallen ); displayName = tr_http_unescape( val, vallen );
if( ( keylen==2 ) && !memcmp( key, "tr", 2 ) ) if( ( keylen==2 ) && !memcmp( key, "tr", 2 ) && ( trCount < MAX_TRACKERS ) )
tr[trCount++] = tr_http_unescape( val, vallen ); tr[trCount++] = tr_http_unescape( val, vallen );
if( ( keylen==2 ) && !memcmp( key, "ws", 2 ) ) if( ( keylen==2 ) && !memcmp( key, "ws", 2 ) && ( wsCount < MAX_TRACKERS ) )
ws[wsCount++] = tr_http_unescape( val, vallen ); ws[wsCount++] = tr_http_unescape( val, vallen );
walk = next != NULL ? next + 1 : NULL; walk = next != NULL ? next + 1 : NULL;