*** empty log message ***

src/peer_connection.cpp

@@ -440,20 +440,30 @@ bool libtorrent::peer_connection::dispatch_message(int received)
 			r.start = read_int(&m_recv_buffer[5]);
 			r.length = read_int(&m_recv_buffer[9]);
 
-			if (!m_choked)
+			// make sure this request
+			// is legal and taht the peer
+			// is not choked
+			if (r.piece >= 0
+				&& r.piece < m_torrent->torrent_file().num_pieces()
+				&& r.start >= 0
+				&& r.start < m_torrent->torrent_file().piece_size(r.piece)
+				&& r.length > 0
+				&& r.length + r.start < m_torrent->torrent_file().piece_size(r.piece)
+				&& !m_choked)
 			{
 				m_requests.push_back(r);
 				send_buffer_updated();
-			}
-			else
-			{
-				// ignoring request since we have
-				// choked this peer
-			}
-
 #ifndef NDEBUG
 				(*m_logger) << m_socket->sender().as_string() << " <== REQUEST [ piece: " << r.piece << " | s: " << r.start << " | l: " << r.length << " ]\n";
 #endif
+			}
+			else
+			{
+				// TODO: log this illegal request
+				// if the only error is that the
+				// peer is choked, it may not be a
+				// mistake
+			}
 
 			break;
 		}
@@ -1130,6 +1140,12 @@ void libtorrent::peer_connection::send_data()
 				throw network_error(0);
 			}
 
+			if (r.length <= 0 || r.start < 0)
+			{
+				// NOT OK! disconnect
+				throw network_error(0);
+			}
+
 #ifndef NDEBUG
 			assert(m_torrent->verify_piece(r.piece) && "internal error");
 #endif

src/policy.cpp

@@ -517,6 +517,7 @@ namespace libtorrent
 				if (i->connection == 0) continue;
 				// if we're not interested, we will not become interested
 				if (!i->connection->is_interesting()) continue;
+				if (!i->connection->has_piece(index)) continue;
 
 				bool interested = false;
 				const std::vector<bool>& peer_has = i->connection->get_bitfield();

src/storage.cpp

@@ -180,6 +180,8 @@ namespace libtorrent {
 	  , size_type offset
   	  , size_type size)
 	{
+		assert(offset >= 0);
+		assert(offset < m_pimpl->info.piece_size(slot));
 		assert(size > 0);
 
 		slot_lock lock(*m_pimpl, slot);

src/torrent.cpp

@@ -559,6 +559,7 @@ namespace libtorrent
 	{
 		size_type size = m_torrent_file.piece_size(piece_index);
 		std::vector<char> buffer(size);
+		assert(size > 0);
 		m_storage.read(&buffer[0], piece_index, 0, size);
 
 		hasher h;