fix out-of-bounds read in bdecode

Fixes #2099
arvidn · Jun 24, 2017 · ec30a5e · ec30a5e
1 parent 77cc2b4
commit ec30a5e
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/src/bdecode.cpp b/src/bdecode.cpp
@@ -839,6 +839,7 @@ namespace libtorrent
 					boost::int64_t len = t - '0';
 					char const* str_start = start;
 					++start;
+					if (start >= end) TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof);
 					bdecode_errors::error_code_enum e = bdecode_errors::no_error;
 					start = parse_int(start, end, ':', len, e);
 					if (e)

diff --git a/test/test_bdecode.cpp b/test/test_bdecode.cpp
@@ -459,18 +459,18 @@ TORRENT_TEST(unepected_eof)
 	printf("%s\n", print_entry(e).c_str());
 }
 
-// test unexpected EOF (really expected terminator)
+// test unexpected EOF in string length
 TORRENT_TEST(unepected_eof2)
 {
-	char b[] = "l2:..0"; // expected terminating 'e' instead of '0'
+	char b[] = "l2:..0"; // expected ':' delimiter instead of EOF
 
 	bdecode_node e;
 	error_code ec;
 	int pos;
 	int ret = bdecode(b, b + sizeof(b)-1, e, ec, &pos);
 	TEST_EQUAL(ret, -1);
 	TEST_EQUAL(pos, 6);
-	TEST_EQUAL(ec, error_code(bdecode_errors::expected_colon));
+	TEST_EQUAL(ec, error_code(bdecode_errors::unexpected_eof));
 	printf("%s\n", print_entry(e).c_str());
 }