Possible security issue…

[veryfoolish]

Libtorrent allows an arbitrary number of leading zeros on bytestrings in Bencode decoding; I can see some potential for buffer overflow here. I.e., via a malicious tracker, peer, or Metainfo file.

Bytestrings should not have leading zeros ever because you'll never have a 0 length bytestring (although the Bittorrent 'spec' allows you to express something like i0e which is meaningless.

To recap:

d0000000000000000000000000000000000000000000000000000000000000000000000005:hello000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005:helloe

shouldn't be accepted. Modify a .torrent file and you'll see this works...

[deoxxa]

How would that cause a buffer overflow exactly?

[rakshasa]

It can only really cause invalid re-encoded bencodes.