From cfbe53da5d9ef8dad1bb3276c0b33ec2ab6e974b Mon Sep 17 00:00:00 2001 From: Dirk Engling Date: Sat, 7 Nov 2026 13:30:17 +0100 Subject: Fix s24s stats to ensure no unallocated vector is dereferenced. Drive-by fix for the ip= scanner in the http parser --- src/ot_http.c | 4 +++- src/ot_stats.c | 6 +++++- 2 files changed, 8 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/ot_http.c b/src/ot_http.c index 1b5281c..262936e 100644 --- a/src/ot_http.c +++ b/src/ot_http.c @@ -692,8 +692,10 @@ static ssize_t http_handle_announce(const int64_t sock, struct ot_workstruct { char *tmp_buf1 = ws->reply, *tmp_buf2 = ws->reply + 16; len = urlencoded_parse(&read_ptr, tmp_buf2, ws->outbuf + G_OUTBUF_SIZE, SCAN_SEARCHPATH_VALUE); + if (len <= 0) + HTTPERROR_400_PARAM; tmp_buf2[len] = 0; - if ((len <= 0) || ip_parse(tmp_buf2, tmp_buf1) != (size_t)len) + if (ip_parse(tmp_buf2, tmp_buf1) != (size_t)len) HTTPERROR_400_PARAM; OT_SETIP(&ws->peer, tmp_buf1); } break; diff --git a/src/ot_stats.c b/src/ot_stats.c index c50d4e3..9e2eabe 100644 --- a/src/ot_stats.c +++ b/src/ot_stats.c @@ -244,9 +244,13 @@ static void stats_slash24s_txt(char **reply, const char *reply_end, size_t amoun ot_vector *torrents_list = mutex_bucket_lock(bucket); for (i = 0; i < torrents_list->size; ++i) { ot_peerlist *peer_list = (((ot_torrent *)(torrents_list->data))[i]).peer_list4; - ot_vector *bucket_list = &peer_list->peers; + ot_vector *bucket_list; int num_buckets = 1; + if (!peer_list) + continue; + bucket_list = &peer_list->peers; + if (OT_PEERLIST_HASBUCKETS(peer_list)) { num_buckets = bucket_list->size; bucket_list = (ot_vector *)bucket_list->data; -- cgit v1.3