Changeset 241 for trunk/libtransmission

Timestamp:

Apr 25, 2006, 7:00:18 AM (17 years ago)

Author:

joshe

Message:

Make sure not to go past the end of the buffer when loading bencoded data.
Add code to encode using bencoding.

Location:

trunk/libtransmission

Files:

• bencode.c (modified) (6 diffs)
• bencode.h (modified) (1 diff)
• metainfo.c (modified) (1 diff)
• tracker.c (modified) (2 diffs)

trunk/libtransmission/bencode.c

@@ -23 +23 @@
 #include "transmission.h"
 
-#define LIST_SIZE 20
-
-int _tr_bencLoad( char * buf, benc_val_t * val, char ** end )
-{
-    char * p, * foo;
+#define LIST_SIZE   20
+#define OUTBUF_SIZE 100
+
+static int tr_bencSprintf( char ** buf, size_t * used, size_t * max,
+                           char * format, ... )
+#ifdef __GNUC__
+    __attribute__ ((format (printf, 4, 5)))
+#endif
+    ;
+
+int _tr_bencLoad( char * buf, size_t len, benc_val_t * val, char ** end )
+{
+    char * p, * e, * foo;
+
+    if( 1 >= len )
+    {
+        return 1;
+    }
 
     if( !end )
@@ -39 +52 @@
     if( buf[0] == 'i' )
     {
+        e = memchr( &buf[1], 'e', len - 1 );
+        if( NULL == e )
+        {
+            return 1;
+        }
+
         /* Integer: i1242e */
         val->type  = TYPE_INT;
+        *e         = '\0';
         val->val.i = strtoll( &buf[1], &p, 10 );
-
-        if( p == &buf[1] || p[0] != 'e' )
+        *e         = 'e';
+
+        if( p != e )
         {
             return 1;
@@ -67 +88 @@
         cur              = &buf[1];
         str_expected     = 1;
-        while( cur[0] != 'e' )
+        while( (size_t)(cur - buf) < len && cur[0] != 'e' )
         {
             if( val->val.l.count == val->val.l.alloc )
@@ -76 +97 @@
                         val->val.l.alloc  * sizeof( benc_val_t ) );
             }
-            if( tr_bencLoad( cur, &val->val.l.vals[val->val.l.count], &p ) )
+            if( tr_bencLoad( cur, len - (cur - buf),
+                             &val->val.l.vals[val->val.l.count], &p ) )
             {
                 return 1;
@@ -100 +122 @@
     else
     {
+        e = memchr( buf, ':', len );
+        if( NULL == e )
+        {
+            return 1;
+        }
+
         /* String: 12:whateverword */
         val->type    = TYPE_STR;
+        e[0]         = '\0';
         val->val.s.i = strtol( buf, &p, 10 );
-
-        if( p == buf || p[0] != ':' )
-        {
-            return 1;
-        }
-        
+        e[0]         = ':';
+
+        if( p != e || 0 > val->val.s.i ||
+            (size_t)(val->val.s.i) > len - ((p + 1) - buf) )
+        {
+            return 1;
+        }
+
         val->val.s.s               = malloc( val->val.s.i + 1 );
         val->val.s.s[val->val.s.i] = 0;
@@ -204 +235 @@
     return NULL;
 }
+
+char * tr_bencSaveMalloc( benc_val_t * val, size_t * len )
+{
+    char * buf   = NULL;
+    size_t alloc = 0;
+
+    *len = 0;
+    if( tr_bencSave( val, &buf, len, &alloc ) )
+    {
+        if( NULL != buf )
+        {
+            free(buf);
+        }
+        *len = 0;
+        return NULL;
+    }
+
+    return buf;
+}
+
+int tr_bencSave( benc_val_t * val, char ** buf, size_t * used, size_t * max )
+{
+    int ii;    
+
+    switch( val->type )
+    {
+        case TYPE_INT:
+            if( tr_bencSprintf( buf, used, max, "i%llde", val->val.i ) )
+            {
+                return 1;
+            }
+            break;
+
+        case TYPE_STR:
+            if( (int)strlen(val->val.s.s) != val->val.s.i )
+            {
+                return 1;
+            }
+            if( tr_bencSprintf( buf, used, max, "%i:%s",
+                                val->val.s.i, val->val.s.s ) )
+            {
+                return 1;
+            }
+            break;
+
+        case TYPE_LIST:
+        case TYPE_DICT:
+            if( tr_bencSprintf( buf, used, max,
+                                (TYPE_LIST == val->type ? "l" : "d") ) )
+            {
+                return 1;
+            }
+            for( ii = 0; val->val.l.count > ii; ii++ )
+            {
+                if( tr_bencSave( val->val.l.vals + ii, buf, used, max ) )
+                {
+                    return 1;
+                }
+            }
+            if( tr_bencSprintf( buf, used, max, "e" ) )
+            {
+                return 1;
+            }
+            break;
+    }
+
+    return 0;
+}
+
+static int tr_bencSprintf( char ** buf, size_t * used, size_t * max,
+                           char * format, ... )
+{
+    va_list ap;
+    int     want;
+    char  * newbuf;
+
+    va_start( ap, format );
+    want = vsnprintf( NULL, 0, format, ap );
+    va_end(ap);
+
+    while( *used + want + 1 > *max )
+    {
+        *max += OUTBUF_SIZE;
+        newbuf = realloc( *buf, *max );
+        if( NULL == newbuf )
+        {
+            return 1;
+        }
+        *buf = newbuf;
+    }
+
+    va_start( ap, format );
+    *used += vsnprintf( *buf + *used, *max - *used, format, ap );
+    va_end( ap );
+
+    return 0;
+}

trunk/libtransmission/bencode.h

@@ -50 +50 @@
 } benc_val_t;
 
-#define tr_bencLoad(b,v,e) _tr_bencLoad((char*)(b),v,(char**)e)
-int          _tr_bencLoad( char * buf, benc_val_t * val, char ** end );
+#define tr_bencLoad(b,l,v,e) _tr_bencLoad((char*)(b),(l),(v),(char**)(e))
+int          _tr_bencLoad( char * buf, size_t len, benc_val_t * val,
+                           char ** end );
 void         tr_bencPrint( benc_val_t * val );
 void         tr_bencFree( benc_val_t * val );
 benc_val_t * tr_bencDictFind( benc_val_t * val, char * key );
+char *       tr_bencSaveMalloc( benc_val_t * val, size_t * len );
+int          tr_bencSave( benc_val_t * val, char ** buf,
+                          size_t * used, size_t * max );
 
 #endif

trunk/libtransmission/metainfo.c

@@ -79 +79 @@
 
     /* Parse bencoded infos */
-    if( tr_bencLoad( buf, &meta, NULL ) )
+    if( tr_bencLoad( buf, sb.st_size, &meta, NULL ) )
     {
         fprintf( stderr, "Error while parsing bencoded data\n" );

trunk/libtransmission/tracker.c

@@ -463 +463 @@
     }
 
-    if( tr_bencLoad( &body[i], &beAll, NULL ) )
+    if( tr_bencLoad( &body[i], bodylen - i, &beAll, NULL ) )
     {
         tr_err( "Tracker: error parsing bencoded data" );
@@ -707 +707 @@
         return 1;
     }
-    if( tr_bencLoad( &buf[i], &scrape, NULL ) )
+    if( tr_bencLoad( &buf[i], pos - i, &scrape, NULL ) )
     {
         return 1;