rakshasa/libtorrent — Issue #12: Possible security issue…
Author: veryfoolish
Created: 2012-02-16 02:07:18+00:00
State: open

Libtorrent allows an arbitrary number of leading zeros on bytestrings in Bencode decoding; I can see some potential for buffer overflow here. I.e., via a malicious tracker, peer, or Metainfo file.

Bytestrings should not have leading zeros ever because you'll never have a 0 length bytestring (although the Bittorrent 'spec' allows you to express something like i0e which is meaningless.

To recap:

d0000000000000000000000000000000000000000000000000000000000000000000000005:hello000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005:helloe

shouldn't be accepted. Modify a .torrent file and you'll see this works...