mirror/transmission
1
0
Fork 0
mirror of https://github.com/transmission/transmission synced 2024-12-26 09:37:56 +00:00
Code Issues Releases Wiki Activity

(trunk libT) #2673 "crash in tr_torrentGetMetadataPiece" -- add safeguards against small sizes

Browse source
This commit is contained in:
Charles Kerr 2009-12-15 16:34:12 +00:00
parent 5ea18bc4ec
commit c17932f533
1 changed files with 17 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
libtransmission/torrent-magnet.c
View file

@ -107,16 +107,19 @@ tr_torrentGetMetadataPiece( const tr_torrent * tor, int piece, int * len )
FILE * fp = fopen( tor->info.torrent, "rb" );
if( fp != NULL )
{
const int offset = piece * METADATA_PIECE_SIZE;
const int o = piece * METADATA_PIECE_SIZE;
if( !fseek( fp, tor->infoDictOffset + offset, SEEK_SET ) )
if( !fseek( fp, tor->infoDictOffset + o, SEEK_SET ) )
{
const int l = offset + METADATA_PIECE_SIZE <= tor->infoDictLength
const int l = o + METADATA_PIECE_SIZE <= tor->infoDictLength
? METADATA_PIECE_SIZE
: tor->infoDictLength - offset;
: tor->infoDictLength - o;
if( 0<l && l<=METADATA_PIECE_SIZE )
{
char * buf = tr_new( char, l );
const int n = fread( buf, 1, l, fp );
if( n != l )
if( n == l )
{
*len = l;
ret = buf;
@ -125,6 +128,7 @@ tr_torrentGetMetadataPiece( const tr_torrent * tor, int piece, int * len )
tr_free( buf );
}
}
fclose( fp );
}