mirror/transmission
1
0
Fork 0
mirror of https://github.com/transmission/transmission synced 2024-12-26 01:27:28 +00:00
Code Issues Releases Wiki Activity

(trunk libT) #2673 "crash in tr_torrentGetMetadataPiece" -- add safeguards against small sizes

Browse source
This commit is contained in:
Charles Kerr 2009-12-15 16:34:12 +00:00
parent 5ea18bc4ec
commit c17932f533
1 changed files with 17 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
libtransmission/torrent-magnet.c
View file

@ -107,23 +107,27 @@ tr_torrentGetMetadataPiece( const tr_torrent * tor, int piece, int * len )
FILE * fp = fopen( tor->info.torrent, "rb" );
if( fp != NULL )
{
const int offset = piece * METADATA_PIECE_SIZE;
const int o = piece * METADATA_PIECE_SIZE;
if( !fseek( fp, tor->infoDictOffset + offset, SEEK_SET ) )
if( !fseek( fp, tor->infoDictOffset + o, SEEK_SET ) )
{
const int l = offset + METADATA_PIECE_SIZE <= tor->infoDictLength
const int l = o + METADATA_PIECE_SIZE <= tor->infoDictLength
? METADATA_PIECE_SIZE
: tor->infoDictLength - offset;
char * buf = tr_new( char, l );
const int n = fread( buf, 1, l, fp );
if( n != l )
{
*len = l;
ret = buf;
buf = NULL;
}
: tor->infoDictLength - o;
tr_free( buf );
if( 0<l && l<=METADATA_PIECE_SIZE )
{
char * buf = tr_new( char, l );
const int n = fread( buf, 1, l, fp );
if( n == l )
{
*len = l;
ret = buf;
buf = NULL;
}
tr_free( buf );
}
}
fclose( fp );