Changeset 10022

Timestamp:

Jan 26, 2010, 8:38:04 PM (12 years ago)

Author:

charles

Message:

(trunk libT) #2800 "crashing during operation" -- if a peer sends an out-of-bounds "have piece" message, drop the connection

File:

• trunk/libtransmission/peer-msgs.c (modified) (1 diff)

trunk/libtransmission/peer-msgs.c

@@ -1426 +1426 @@
             tr_peerIoReadUint32( msgs->peer->io, inbuf, &ui32 );
             dbgmsg( msgs, "got Have: %u", ui32 );
-            if( tr_bitsetAdd( &msgs->peer->have, ui32 ) ) {
+            if( tr_torrentHasMetadata( msgs->torrent )
+                    && ( ui32 >= msgs->torrent->info.pieceCount ) )
+            {
+                fireError( msgs, ERANGE );
+                return READ_ERR;
+            }
+            if( tr_bitsetAdd( &msgs->peer->have, ui32 ) )
+            {
                 fireError( msgs, ERANGE );
                 return READ_ERR;