Changeset 12159

Timestamp:

Mar 14, 2011, 2:39:11 AM (12 years ago)

Author:

jordan

Message:

(trunk libT) fix array-bounds-read in the UDP tracker code when an announce or scrape request times out

File:

• trunk/libtransmission/announcer-udp.c (modified) (3 diffs)

trunk/libtransmission/announcer-udp.c

@@ -60 +60 @@
         sockfd = -1;
 
-    if( sockfd <  0 ) {
+    if( sockfd < 0 ) {
         errno = EAFNOSUPPORT;
         return -1;
@@ -561 +561 @@
             tau_announce_request_fail( tracker->session, req, FALSE, TRUE, NULL );
             tau_announce_request_free( req );
-            tr_ptrArrayRemove( reqs, i-- );
+            tr_ptrArrayRemove( reqs, i );
+            --i;
+            --n;
         }
     }
@@ -578 +580 @@
             tau_scrape_request_fail( tracker->session, req, FALSE, TRUE, NULL );
             tau_scrape_request_free( req );
-            tr_ptrArrayRemove( reqs, i-- );
+            tr_ptrArrayRemove( reqs, i );
+            --i;
+            --n;
         }
     }