diff --git a/ctorrent-CVE-2009-1759.patch b/ctorrent-CVE-2009-1759.patch index 396de9a..0df2047 100644 --- a/ctorrent-CVE-2009-1759.patch +++ b/ctorrent-CVE-2009-1759.patch @@ -1,6 +1,6 @@ -diff -up ctorrent-dnh2.1/bencode.cpp.orig ctorrent-dnh2.1/bencode.cpp ---- ctorrent-dnh2.1/bencode.cpp.orig 2006-01-02 03:38:01.000000000 +0100 -+++ ctorrent-dnh2.1/bencode.cpp 2009-08-22 16:43:47.000000000 +0200 +diff -up ctorrent-dnh2.1/bencode.cpp.cve ctorrent-dnh2.1/bencode.cpp +--- ctorrent-dnh2.1/bencode.cpp.cve 2006-01-02 03:38:01.000000000 +0100 ++++ ctorrent-dnh2.1/bencode.cpp 2009-08-22 17:16:00.000000000 +0200 @@ -234,22 +234,28 @@ size_t bencode_path2list(const char *pat return bencode_end_dict_list(fp); } @@ -34,9 +34,9 @@ diff -up ctorrent-dnh2.1/bencode.cpp.orig ctorrent-dnh2.1/bencode.cpp } *pathname = '\0'; return (pb - b + 1); -diff -up ctorrent-dnh2.1/bencode.h.orig ctorrent-dnh2.1/bencode.h ---- ctorrent-dnh2.1/bencode.h.orig 2005-08-27 05:43:00.000000000 +0200 -+++ ctorrent-dnh2.1/bencode.h 2009-08-22 16:44:17.000000000 +0200 +diff -up ctorrent-dnh2.1/bencode.h.cve ctorrent-dnh2.1/bencode.h +--- ctorrent-dnh2.1/bencode.h.cve 2005-08-27 05:43:00.000000000 +0200 ++++ ctorrent-dnh2.1/bencode.h 2009-08-22 17:16:00.000000000 +0200 @@ -24,7 +24,7 @@ size_t decode_dict(const char *b,size_t size_t decode_list(const char *b,size_t len,const char *keylist); size_t decode_rev(const char *b,size_t len,const char *keylist); @@ -46,9 +46,9 @@ diff -up ctorrent-dnh2.1/bencode.h.orig ctorrent-dnh2.1/bencode.h size_t bencode_buf(const char *str,size_t len,FILE *fp); size_t bencode_str(const char *str, FILE *fp); size_t bencode_int(const int integer, FILE *fp); -diff -up ctorrent-dnh2.1/btfiles.cpp.orig ctorrent-dnh2.1/btfiles.cpp ---- ctorrent-dnh2.1/btfiles.cpp.orig 2006-03-20 04:54:53.000000000 +0100 -+++ ctorrent-dnh2.1/btfiles.cpp 2009-08-22 16:50:03.000000000 +0200 +diff -up ctorrent-dnh2.1/btfiles.cpp.cve ctorrent-dnh2.1/btfiles.cpp +--- ctorrent-dnh2.1/btfiles.cpp.cve 2006-03-20 04:54:53.000000000 +0100 ++++ ctorrent-dnh2.1/btfiles.cpp 2009-08-22 17:18:20.000000000 +0200 @@ -352,6 +352,8 @@ int btFiles::BuildFromMI(const char *met BTFILE *pbf_last = (BTFILE*) 0; BTFILE *pbf = (BTFILE*) 0; @@ -58,7 +58,7 @@ diff -up ctorrent-dnh2.1/btfiles.cpp.orig ctorrent-dnh2.1/btfiles.cpp if( decode_query(metabuf,metabuf_len,"info|length", (const char**) 0,(size_t*) 0,(int64_t*) 0,QUERY_LONG) ) return -1; -@@ -381,11 +383,19 @@ int btFiles::BuildFromMI(const char *met +@@ -381,11 +383,16 @@ int btFiles::BuildFromMI(const char *met #ifndef WINDOWS if( !pbf ) return -1; #endif @@ -66,11 +66,10 @@ diff -up ctorrent-dnh2.1/btfiles.cpp.orig ctorrent-dnh2.1/btfiles.cpp pbf->bf_length = t; m_total_files_length += t; r = decode_query(p, dl, "path", (const char **) 0, &n,(int64_t*) 0,QUERY_POS); - if( !r ) return -1; - if(!decode_list2path(p + r, n, path)) return -1; +- if( !r ) return -1; +- if(!decode_list2path(p + r, n, path)) return -1; + if( !r || !decode_list2path(p + r, n, path, sizeof(path)) ){ -+ CONSOLE.Warning(1, -+ "error, invalid path in torrent data for file %lu at offset %llu", ++ fprintf(stderr,"error, invalid path in torrent data for file %lu at offset %llu", + nfiles, m_total_files_length - t); + delete pbf; + return -1;