From e2240e0831034e11b2754d349bf09ee59db81aa4 Mon Sep 17 00:00:00 2001
From: Jordan Lee <jordan@transmissionbt.com>
Date: Fri, 16 Sep 2011 22:55:58 +0000
Subject: [PATCH] (trunk libT) #4473 'underflow from malformed ssha1 can crash
 tr_ssha1_matches()' -- bah, fix oops in r12884.

---
 libtransmission/crypto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libtransmission/crypto.c b/libtransmission/crypto.c
index e6cc1d1d0..96987b5f2 100644
--- a/libtransmission/crypto.c
+++ b/libtransmission/crypto.c
@@ -382,7 +382,7 @@ tr_ssha1_matches( const char * source, const char * pass )
     /* extract the salt */
     if( sourcelen < 2*SHA_DIGEST_LENGTH-1 )
         return false;
-    saltlen = sourcelen - SHA_DIGEST_LENGTH-1;
+    saltlen = sourcelen - 2*SHA_DIGEST_LENGTH-1;
     salt = tr_malloc( saltlen );
     memcpy( salt, source + 2*SHA_DIGEST_LENGTH+1, saltlen );