fix invalid memory access in utp_stream and torrent (#1084)

fix invalid memory access in uTP PMTUd
This commit is contained in:
milesdong 2016-09-13 14:36:23 +08:00 committed by Arvid Norberg
parent e4a27c0b4b
commit dc4d9af2e6
2 changed files with 4 additions and 1 deletions

View File

@ -1989,9 +1989,10 @@ namespace libtorrent
file_storage const& fs = m_torrent_file->files();
for (int i = 0; i < fs.num_files(); ++i)
{
if (!fs.pad_file_at(i) || fs.file_size(i) == 0) continue;
if (fs.pad_file_at(i)) ++num_pad_files;
if (!fs.pad_file_at(i) || fs.file_size(i) == 0) continue;
m_padding += boost::uint32_t(fs.file_size(i));
// TODO: instead of creating the picker up front here,

View File

@ -1822,6 +1822,7 @@ bool utp_socket_impl::send_pkt(int const flags)
int const effective_mtu = mtu_probe ? m_mtu : m_mtu_floor;
int payload_size = (std::min)(m_write_buffer_size
, effective_mtu - header_size);
TORRENT_ASSERT(payload_size >= 0);
// if we have one MSS worth of data, make sure it fits in our
// congestion window and the advertised receive window from
@ -1924,6 +1925,7 @@ bool utp_socket_impl::send_pkt(int const flags)
#ifdef TORRENT_DEBUG
p->num_fast_resend = 0;
#endif
p->mtu_probe = false;
p->need_resend = false;
ptr = p->buf;
h = reinterpret_cast<utp_header*>(ptr);