wornvirtue
/
premiere-libtorrent
forked from premiere/premiere-libtorrent
1
0
Fork 0
Code Pull Requests Activity

fix invalid memory access in utp_stream and torrent (#1084) 

fix invalid memory access in uTP PMTUd
This commit is contained in:
milesdong 2016-09-13 14:36:23 +08:00 committed by Arvid Norberg
parent e4a27c0b4b
commit dc4d9af2e6
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/torrent.cpp
View File

@ -1989,9 +1989,10 @@ namespace libtorrent
file_storage const& fs = m_torrent_file->files(); file_storage const& fs = m_torrent_file->files();
for (int i = 0; i < fs.num_files(); ++i) for (int i = 0; i < fs.num_files(); ++i)
{ {
if (!fs.pad_file_at(i) || fs.file_size(i) == 0) continue;
if (fs.pad_file_at(i)) ++num_pad_files; if (fs.pad_file_at(i)) ++num_pad_files;
if (!fs.pad_file_at(i) || fs.file_size(i) == 0) continue;
m_padding += boost::uint32_t(fs.file_size(i)); m_padding += boost::uint32_t(fs.file_size(i));
// TODO: instead of creating the picker up front here, // TODO: instead of creating the picker up front here,

2
src/utp_stream.cpp
View File

@ -1822,6 +1822,7 @@ bool utp_socket_impl::send_pkt(int const flags)
int const effective_mtu = mtu_probe ? m_mtu : m_mtu_floor; int const effective_mtu = mtu_probe ? m_mtu : m_mtu_floor;
int payload_size = (std::min)(m_write_buffer_size int payload_size = (std::min)(m_write_buffer_size
, effective_mtu - header_size); , effective_mtu - header_size);
TORRENT_ASSERT(payload_size >= 0);
// if we have one MSS worth of data, make sure it fits in our // if we have one MSS worth of data, make sure it fits in our
// congestion window and the advertised receive window from // congestion window and the advertised receive window from
@ -1924,6 +1925,7 @@ bool utp_socket_impl::send_pkt(int const flags)
#ifdef TORRENT_DEBUG #ifdef TORRENT_DEBUG
p->num_fast_resend = 0; p->num_fast_resend = 0;
#endif #endif
p->mtu_probe = false;
p->need_resend = false; p->need_resend = false;
ptr = p->buf; ptr = p->buf;
h = reinterpret_cast<utp_header*>(ptr); h = reinterpret_cast<utp_header*>(ptr);