Changeset 12159


Ignore:
Timestamp:
Mar 14, 2011, 2:39:11 AM (11 years ago)
Author:
jordan
Message:

(trunk libT) fix array-bounds-read in the UDP tracker code when an announce or scrape request times out

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/libtransmission/announcer-udp.c

    r12152 r12159  
    6060        sockfd = -1;
    6161
    62     if( sockfd <  0 ) {
     62    if( sockfd < 0 ) {
    6363        errno = EAFNOSUPPORT;
    6464        return -1;
     
    561561            tau_announce_request_fail( tracker->session, req, FALSE, TRUE, NULL );
    562562            tau_announce_request_free( req );
    563             tr_ptrArrayRemove( reqs, i-- );
     563            tr_ptrArrayRemove( reqs, i );
     564            --i;
     565            --n;
    564566        }
    565567    }
     
    578580            tau_scrape_request_fail( tracker->session, req, FALSE, TRUE, NULL );
    579581            tau_scrape_request_free( req );
    580             tr_ptrArrayRemove( reqs, i-- );
     582            tr_ptrArrayRemove( reqs, i );
     583            --i;
     584            --n;
    581585        }
    582586    }
Note: See TracChangeset for help on using the changeset viewer.