Changeset 65 for trunk

Timestamp:

23.10.2006 12:46:20 (2 years ago)

Author:

m

Message:

Added changes from Bug #9093 to Decode.php. Added test cases. Added AllTest?.php.

Location:

trunk

Files:

• File/Bittorrent/Decode.php (modified) (10 diffs)
• Tests/AllTests.php (added)
• Tests/FileBittorrent.php (modified) (4 diffs)

trunk/File/Bittorrent/Decode.php

@@ -4 +4 @@
 // | Decode and Encode data in Bittorrent format                          |
 // +----------------------------------------------------------------------+
-// | Copyright (C) 2004-2005 Markus Tacker <m@tacker.org>                 |
+// | Copyright (C) 2004-2006 Markus Tacker <m@tacker.org>                 |
 // +----------------------------------------------------------------------+
 // | This library is free software; you can redistribute it and/or        |
@@ -40 +40 @@
 * @category File
 * @author Markus Tacker <m@tacker.org>
+* @author Robin H. Johnson <robbat2@gentoo.org>
 * @version $Id$
 */
@@ -73 +74 @@
 * @category File
 * @author Markus Tacker <m@tacker.org>
+* @author Robin H. Johnson <robbat2@gentoo.org>
 */
 class File_Bittorrent_Decode
@@ -165 +167 @@
         $this->_position  = 0;
         $this->_source_length = strlen($this->_source);
-        return $this->_bdecode();
+        $result = $this->_bdecode();
+        if ($this->_position < $this->_source_length) {
+            $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::decode() - Trailing garbage in file.');
+            return false;
+        }
+        return $result;
     }
 
@@ -239 +246 @@
             }
         // In case the torrent contains only on file
-        } elseif(isset($this->decoded['info']['name']))  {
+        } elseif (isset($this->decoded['info']['name']))  {
                 $this->files[] = array(
                    'filename' => $this->decoded['info']['name'],
@@ -316 +323 @@
     function _decode_dict()
     {
+        $return = array();
+        $ended = false;
+        $lastkey = NULL;
         while ($char = $this->_getChar()) {
-            if ($char == 'e') break;
+            if ($char == 'e') {
+                $ended = true;
+                break;
+            }
+            if (!ctype_digit($char)) {
+                $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_dict() - Invalid dictionary key.');
+                $return = false;
+                break;
+            }
             $key = $this->_decode_string();
+            if (isset($return[$key])) {
+                $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_dict() - Duplicate dictionary key.');
+                $return = false;
+                break;
+            }
+            if ($key < $lastkey) {
+                $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_dict() - Missorted dictionary key.');
+                $return = false;
+                break;
+            }
             $val = $this->_bdecode();
+            if ($val === false) {
+                $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_dict() - Invalid value.');
+                $return = false;
+                break;
+            }
             $return[$key] = $val;
+            $lastkey = $key;
+        }
+        if (!$ended) {
+            $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_dict() - Unterminated dictionary.');
+            $return = false;
         }
         $this->_position++;
@@ -338 +376 @@
     function _decode_string()
     {
+        // Check for bad leading zero
+        if (substr($this->_source, $this->_position, 1) == '0' and
+        substr($this->_source, $this->_position + 1, 1) != ':') {
+            $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_string() - Leading zero in string length.');
+            return false;
+        }
         // Find position of colon
         // Supress error message if colon is not found which may be caused by a corrupted or wrong encoded string
-        if(!$pos_colon = @strpos($this->_source, ':', $this->_position)) {
+        if (!$pos_colon = @strpos($this->_source, ':', $this->_position)) {
+            $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_string() - Colon not found.');
             return false;
         }
         // Get length of string
         $str_length = intval(substr($this->_source, $this->_position, $pos_colon));
+        if ($str_length + $pos_colon + 1 > $this->_source_length) {
+            $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_string() - Input too short for string length.');
+            return false;
+        }
         // Get string
-        $return = substr($this->_source, $pos_colon + 1, $str_length);
+        if ($str_length === 0) {
+            $return = '';
+        } else {
+            $return = substr($this->_source, $pos_colon + 1, $str_length);
+        }
         // Move Pointer after string
         $this->_position = $pos_colon + $str_length + 1;
@@ -365 +418 @@
     {
         $pos_e  = strpos($this->_source, 'e', $this->_position);
+        $p = $this->_position;
+        if ($p === $pos_e) {
+            $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_int() - Empty integer.');
+            return false;
+        }
+        if (substr($this->_source, $this->_position, 1) == '-') $p++;
+        if (substr($this->_source, $p, 1) == '0' and
+        ($p != $this->_position or $pos_e > $p+1)) {
+            $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_int() - Leading zero in integer.');
+            return false;
+        }
+        for ($i = $p; $i < $pos_e-1; $i++) {
+            if (!ctype_digit(substr($this->_source, $i, 1))) {
+                $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_int() - Non-digit characters in integer.');
+                return false;
+            }
+        }
         // The return value showld be automatically casted to float if the intval would
         // overflow. The "+ 0" accomplishes exactly that, using the internal casting
@@ -389 +459 @@
         $return = array();
         $char = $this->_getChar();
-        while ($this->_source{$this->_position} != 'e') {
+        $p1 = $p2 = 0;
+        if ($char === false) {
+            $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_list() - Unterminated list.');
+            return false;
+        }
+        while ($char !== false && substr($this->_source, $this->_position, 1) != 'e') {
+            $p1 = $this->_position;
             $val = $this->_bdecode();
+            $p2 = $this->_position;
+            // Empty does not work here
+            if($p1 == $p2)  {
+                $this->last_error = PEAR::raiseError('File_Bittorrent_Decode::_decode_list() - Unterminated list.');
+                return false;
+            }
             $return[] = $val;
         }
@@ -407 +489 @@
         if (empty($this->_source)) return false;
         if ($this->_position >= $this->_source_length) return false;
-        return $this->_source{$this->_position};
+        return substr($this->_source, $this->_position, 1);
     }
 

trunk/Tests/FileBittorrent.php

@@ -4 +4 @@
 // | Decode and Encode data in Bittorrent format                          |
 // +----------------------------------------------------------------------+
-// | Copyright (C) 2004-2005 Markus Tacker <m@tacker.org>                 |
+// | Copyright (C) 2004-2006 Markus Tacker <m@tacker.org>                 |
 // +----------------------------------------------------------------------+
 // | This library is free software; you can redistribute it and/or        |
@@ -29 +29 @@
     * @category File
     * @author Markus Tacker <m@tacker.org>
+    * @author Robin H. Johnson <robbat2@gentoo.org>
     * @version $Id$
     */
@@ -42 +43 @@
     * @category File
     * @author Markus Tacker <m@tacker.org>
+    * @author Robin H. Johnson <robbat2@gentoo.org>
     * @version $Id$
     */
@@ -55 +57 @@
             $this->assertEquals($File_Bittorrent_Decode->info_hash, substr($bt[3], strpos($bt[3], ':') + 2));
         }
+
+        public function testDecode()
+        {
+            $test_data = array(
+                '0:0:'                     => false, // data past end of first correct bencoded string
+                'ie'                       => false, // empty integer
+                'i341foo382e'              => false, // malformed integer
+                'i4e'                      => 4,
+                'i0e'                      => 0,
+                'i123456789e'              => 123456789,
+                'i-10e'                    => -10,
+                'i-0e'                     => false, // negative zero integer
+                'i123'                     => false, // unterminated integer
+                ''                         => false, // empty string
+                'i6easd'                   => false, // integer with trailing garbage
+                '35208734823ljdahflajhdf'  => false, // garbage looking vaguely like a string, with large count
+                '2:abfdjslhfld'            => false, // string with trailing garbage
+                '0:'                       => '',
+                '3:abc'                    => 'abc',
+                '10:1234567890'            => '1234567890',
+                '02:xy'                    => false, // string with extra leading zero in count
+                'l'                        => false, // unclosed empty list
+                'le'                       => array(),
+                'leanfdldjfh'              => false, // empty list with trailing garbage
+                'l0:0:0:e'                 => array('', '', ''),
+                'relwjhrlewjh'             => false, // complete garbage
+                'li1ei2ei3ee'              => array( 1, 2, 3 ),
+                'l3:asd2:xye'              => array( 'asd', 'xy' ),
+                'll5:Alice3:Bobeli2ei3eee' => array ( array( 'Alice', 'Bob' ), array( 2, 3 ) ),
+                'd'                        => false, // unclosed empty dict
+                'defoobar'                 => false, // empty dict with trailing garbage
+                'de'                       => array(),
+                'd1:a0:e'                  => array('a'=>''),
+                'd3:agei25e4:eyes4:bluee'  => array('age' => 25, 'eyes' => 'blue' ),
+                'd8:spam.mp3d6:author5:Alice6:lengthi100000eee' => array('spam.mp3' => array( 'author' => 'Alice', 'length' => 100000 )),
+                'd3:fooe'                  => false, // dict with odd number of elements
+                'di1e0:e'                  => false, // dict with integer key
+                'd1:b0:1:a0:e'             => false, // missorted keys
+                'd1:a0:1:a0:e'             => false, // duplicate keys
+                'i03e'                     => false, // integer with leading zero
+                'l01:ae'                   => false, // list with string with leading zero in count
+                '9999:x'                   => false, // string shorter than count
+                'l0:'                      => false, // unclosed list with content
+                'd0:0:'                    => false, // unclosed dict with content
+                'd0:'                      => false, // unclosed dict with odd number of elements
+                '00:'                      => false, // zero-length string with extra leading zero in count
+                'l-3:e'                    => false, // list with negative-length string
+                'i-03e'                    => false, // negative integer with leading zero
+                'di0e0:e'                  => false, // dictionary with integer key
+                'd8:announceldi0e0:eee'    => false, // nested dictionary with integer key
+                'd8:announcedi0e0:e18:azureus_propertiesi0ee' => false, // nested dictionary with integer key #2
+            );
+            // Thanks to IsoHunt.com for the last 3 testcases of bad data seen in their system.
+
+            $File_Bittorrent_Decode = new File_Bittorrent_Decode;
+            ini_set('mbstring.internal_encoding','ASCII');
+            foreach($test_data as $ti => $to) {
+                $this->assertEquals($to, $File_Bittorrent_Decode->decode($ti));
+            }
+        }
     }