fix integer overflow in torrent_info

src/assert.cpp

@@ -358,7 +358,7 @@ TORRENT_EXPORT void assert_fail(char const* expr, int line
 #else
 	// send SIGINT to the current process
 	// to break into the debugger
-	::raise(SIGINT);
+	::raise(SIGABRT);
 #endif
 	::abort();
 #endif

src/block_cache.cpp

@@ -295,7 +295,7 @@ static_assert(int(job_action_name.size()) == static_cast<int>(job_action_t::num_
 
 
 #define TORRENT_PIECE_ASSERT(cond, piece) \
-	do { if (!(cond)) { assert_print_piece(piece); assert_fail(#cond, __LINE__, __FILE__, TORRENT_FUNCTION, 0); } } TORRENT_WHILE_0
+	do { if (!(cond)) { assert_print_piece(piece); assert_fail(#cond, __LINE__, __FILE__, TORRENT_FUNCTION, nullptr); } } TORRENT_WHILE_0
 
 #else
 #define TORRENT_PIECE_ASSERT(cond, piece) do {} TORRENT_WHILE_0

src/torrent_info.cpp

@@ -944,14 +944,14 @@ namespace {
 		ptrdiff_t const info_ptr_diff = m_info_section.get() - section.data();
 
 		// extract piece length
-		int piece_length = int(info.dict_find_int_value("piece length", -1));
+		std::int64_t piece_length = info.dict_find_int_value("piece length", -1);
-		if (piece_length <= 0)
+		if (piece_length <= 0 || piece_length > std::numeric_limits<int>::max())
 		{
 			ec = errors::torrent_missing_piece_length;
 			return false;
 		}
 		file_storage files;
-		files.set_piece_length(piece_length);
+		files.set_piece_length(static_cast<int>(piece_length));
 
 		// extract file name (or the directory name if it's a multi file libtorrent)
 		bdecode_node name_ent = info.dict_find_string("name.utf-8");
@@ -1001,6 +1001,15 @@ namespace {
 		// we want this division to round upwards, that's why we have the
 		// extra addition
 
+		if (files.total_size() >= std::numeric_limits<int>::max()
+			- files.piece_length())
+		{
+			ec = errors::too_many_pieces_in_torrent;
+			// mark the torrent as invalid
+			m_files.set_piece_length(0);
+			return false;
+		}
+
 		files.set_num_pieces(int((files.total_size() + files.piece_length() - 1)
 			/ files.piece_length()));