Changeset 9774

Timestamp:

Dec 15, 2009, 4:34:12 PM (12 years ago)

Author:

charles

Message:

(trunk libT) #2673 "crash in tr_torrentGetMetadataPiece" -- add safeguards against small sizes

File:

• trunk/libtransmission/torrent-magnet.c (modified) (1 diff)

trunk/libtransmission/torrent-magnet.c

@@ -108 +108 @@
         if( fp != NULL )
         {
-            const int offset = piece  * METADATA_PIECE_SIZE;
-
-            if( !fseek( fp, tor->infoDictOffset + offset, SEEK_SET ) )
+            const int o = piece  * METADATA_PIECE_SIZE;
+
+            if( !fseek( fp, tor->infoDictOffset + o, SEEK_SET ) )
             {
-                const int l = offset + METADATA_PIECE_SIZE <= tor->infoDictLength
+                const int l = o + METADATA_PIECE_SIZE <= tor->infoDictLength
                             ? METADATA_PIECE_SIZE
-                            : tor->infoDictLength - offset;
-                char * buf = tr_new( char, l );
-                const int n = fread( buf, 1, l, fp );
-                if( n != l )
+                            : tor->infoDictLength - o;
+
+                if( 0<l && l<=METADATA_PIECE_SIZE )
                 {
-                    *len = l;
-                    ret = buf;
-                    buf = NULL;
+                    char * buf = tr_new( char, l );
+                    const int n = fread( buf, 1, l, fp );
+                    if( n == l )
+                    {
+                        *len = l;
+                        ret = buf;
+                        buf = NULL;
+                    }
+
+                    tr_free( buf );
                 }
-
-                tr_free( buf );
             }