Changeset 10279

Timestamp:

Feb 24, 2010, 4:23:36 AM (13 years ago)

Author:

charles

Message:

(trunk libT) #2965: "buffer overflow if too many tr= args in a magnet link" -- fixed in trunk for 1.92. thanks to pjz for the patch.

File:

• trunk/libtransmission/magnet.c (modified) (1 diff)

trunk/libtransmission/magnet.c

@@ -152 +152 @@
                 displayName = tr_http_unescape( val, vallen );
 
-            if( ( keylen==2 ) && !memcmp( key, "tr", 2 ) )
+            if( ( keylen==2 ) && !memcmp( key, "tr", 2 ) && ( trCount < MAX_TRACKERS ) )
                 tr[trCount++] = tr_http_unescape( val, vallen );
 
-            if( ( keylen==2 ) && !memcmp( key, "ws", 2 ) )
+            if( ( keylen==2 ) && !memcmp( key, "ws", 2 ) && ( wsCount < MAX_TRACKERS ) )
                 ws[wsCount++] = tr_http_unescape( val, vallen );