* add sanity checks to incoming piece data requests. This may solve the inout.c:99 assertion failure.

* rename the gtk client from `transmission-gtk' to `transmission' for parity with the mac client.

gtk/Makefile.am

@@ -26,9 +26,9 @@ noinst_HEADERS = \
     ui.h \
     util.h
 
-bin_PROGRAMS = transmission-gtk
+bin_PROGRAMS = transmission
 
-transmission_gtk_SOURCES = \
+transmission_SOURCES = \
     actions.c \
     conf.c \
     dialogs.c \
@@ -47,7 +47,7 @@ transmission_gtk_SOURCES = \
     tr_window.c \
     util.c
 
-transmission_gtk_LDADD = \
+transmission_LDADD = \
     $(top_builddir)/libtransmission/libtransmission.a \
     $(top_builddir)/third-party/libevent/libevent.la \
     $(GTK_LIBS) \

gtk/transmission.desktop

@@ -13,8 +13,8 @@ Comment[pl]=Darmowy, lekki klient BitTorrent z prostym, intuicyjnym interfejscem
 Comment[ro]=Un client BitTorrent liber, neîncărcat, cu o interfaţă simplă şi intuitivă
 Comment[ru]=Свободный, легковесный BitTorrent клиент с простым, интуитивным интерфейсом
 Comment[sv]=En fri, lättviktig BitTorrent-klient med ett enkelt och intuitivt gränssnitt
-Exec=transmission-gtk %F
-TryExec=transmission-gtk
+Exec=transmission %F
+TryExec=transmission
 Icon=transmission.png
 MimeType=application/x-bittorrent;
 Categories=Network;FileTransfer;P2P;GTK;

libtransmission/internal.h

@@ -90,6 +90,7 @@ tr_torrent* tr_torrentFindFromObfuscatedHash( tr_handle *, const uint8_t* );
 #define tr_block(a,b) _tr_block(tor,a,b)
 int _tr_block( const tr_torrent * tor, int index, int begin );
 
+uint64_t tr_pieceOffset( const tr_torrent * tor, int index, int begin, int length );
 
 typedef enum
 {

libtransmission/peer-msgs.c

@@ -606,6 +606,17 @@ readBtLength( tr_peermsgs * msgs, struct evbuffer * inbuf )
     } return READ_AGAIN;
 }
 
+static int
+requestIsValid( const tr_peermsgs * msgs, struct peer_request * req )
+{
+    const tr_torrent * tor = msgs->torrent;
+    assert( req != NULL );
+    assert( req->index < (uint32_t)tor->info.pieceCount );
+    assert( (int)req->offset < tr_torPieceCountBytes( tor, (int)req->index ) );
+    assert( tr_pieceOffset( tor, req->index, req->offset, req->length ) <= tor->info.totalSize );
+    return TRUE;
+}
+
 static int
 readBtMessage( tr_peermsgs * msgs, struct evbuffer * inbuf )
 {
@@ -682,26 +693,23 @@ readBtMessage( tr_peermsgs * msgs, struct evbuffer * inbuf )
             tr_peerIoReadUint32( msgs->io, inbuf, &req->index );
             tr_peerIoReadUint32( msgs->io, inbuf, &req->offset );
             tr_peerIoReadUint32( msgs->io, inbuf, &req->length );
-            if( !msgs->info->peerIsChoked )
+            if( !msgs->info->peerIsChoked && requestIsValid( msgs, req ) )
                 tr_list_append( &msgs->peerAskedFor, req );
+            else
+                tr_free( req );
             break;
         }
 
         case BT_CANCEL: {
             struct peer_request req;
-            tr_list * node;
+            void * data;
             assert( msglen == 12 );
             dbgmsg( msgs, "peer sent us a BT_CANCEL" );
             tr_peerIoReadUint32( msgs->io, inbuf, &req.index );
             tr_peerIoReadUint32( msgs->io, inbuf, &req.offset );
             tr_peerIoReadUint32( msgs->io, inbuf, &req.length );
-            node = tr_list_find( msgs->peerAskedFor, &req, peer_request_compare );
-            if( node != NULL ) {
-                void * data = node->data;
-                tr_list_remove_data( &msgs->peerAskedFor, data );
-                tr_free( data );
-                dbgmsg( msgs, "found the req that peer is cancelling... cancelled." );
-            }
+            data = tr_list_remove( &msgs->peerAskedFor, &req, peer_request_compare );
+            tr_free( data );
             break;
         }
 

libtransmission/torrent.c

@@ -1282,3 +1282,15 @@ int _tr_block( const tr_torrent * tor, int index, int begin )
     return index * ( inf->pieceSize / tor->blockSize ) +
         begin / tor->blockSize;
 }
+
+uint64_t
+tr_pieceOffset( const tr_torrent * tor, int index, int begin, int length )
+{
+    uint64_t ret;
+    ret = tor->info.pieceSize;
+    ret *= index;
+    ret += begin;
+    ret += length;
+    return ret;
+}
+