Skip to content

Commit

Permalink
Fix comparison error in axel_divide
Browse files Browse the repository at this point in the history
The comparison of maxconns and num_connections was inverted, resulting
in a buffer overflow.

Debugging Session:
	gdb --args ./src/axel https://speed.hetzner.de/100MB.bin
	[...]
	Initializing download: https://speed.hetzner.de/100MB.bin
	File size: 104857600 bytes

	Program received signal SIGSEGV, Segmentation fault.
	0x000055555555a81a in axel_divide (axel=0x55555556b410) at axel.c:853
	853                     axel->conn[i].currentbyte = seg_len * i;
	(gdb) p i
	$1 = 87
	(gdb) p axel->conf->num_connections
	$2 = 1024
	(gdb) bt
	#0  0x000055555555a81a in axel_divide (axel=0x55555556b410) at
	axel.c:853
	#1  0x00005555555586e4 in axel_open (axel=0x55555556b410) at axel.c:317
	#2  0x0000555555561bb4 in main (argc=2, argv=0x7fffffffe778) at
	text.c:379

Fixes: 5aac471
	("Fix request range calculation")
Fixes: #205

[ismael: Added commit message]
Signed-off-by: Ismael Luceno <ismael@iodev.co.uk>
  • Loading branch information
foutrelis authored and ismaell committed May 10, 2019
1 parent 4337f0e commit 381459c
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/axel.c
Original file line number Diff line number Diff line change
Expand Up @@ -833,7 +833,7 @@ axel_divide(axel_t *axel)
{
/* Optimize the number of connections in case the file is small */
size_t maxconns = axel->size / MIN_CHUNK_WORTH;
if (maxconns > axel->conf->num_connections)
if (maxconns < axel->conf->num_connections)
axel->conf->num_connections = maxconns;

/* Calculate each segment's size */
Expand Down

0 comments on commit 381459c

Please sign in to comment.