Changeset 10279


Ignore:
Timestamp:
02/24/10 04:23:36 (7 years ago)
Author:
charles
Message:

(trunk libT) #2965: "buffer overflow if too many tr= args in a magnet link" -- fixed in trunk for 1.92. thanks to pjz for the patch.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/libtransmission/magnet.c

    r10084 r10279  
    152152                displayName = tr_http_unescape( val, vallen );
    153153
    154             if( ( keylen==2 ) && !memcmp( key, "tr", 2 ) )
     154            if( ( keylen==2 ) && !memcmp( key, "tr", 2 ) && ( trCount < MAX_TRACKERS ) )
    155155                tr[trCount++] = tr_http_unescape( val, vallen );
    156156
    157             if( ( keylen==2 ) && !memcmp( key, "ws", 2 ) )
     157            if( ( keylen==2 ) && !memcmp( key, "ws", 2 ) && ( wsCount < MAX_TRACKERS ) )
    158158                ws[wsCount++] = tr_http_unescape( val, vallen );
    159159
Note: See TracChangeset for help on using the changeset viewer.