Commit Graph

1784 Commits

Author SHA1 Message Date
xirvik 3652329e2d Pass the typed download filter as an argument, not command text
A pattern containing '}' closed the match command early and ran the rest as commands.
2026-09-20 16:39:14 +02:00
xirvik 7916e6022f Stop the value command on the untrusted-safe allowlist crashing the daemon
glibc leaves endptr unset for a small invalid base; ERANGE throws instead of clamping.
2026-09-20 15:58:47 +02:00
xirvik c59da0848e Dump the ipv4 filter by reference instead of copying the whole map
A static table owns the map; the loop only reads it on the main thread. No test needed.
2026-09-20 15:33:09 +02:00
xirvik e2f66ff08c Drop the address range parser and its includes, dead since 29edda2f
External linkage kept -Wunused-function quiet; a deletion of dead code needs no test.
2026-09-20 15:01:44 +02:00
xirvik f0b6f2cb47 Fail p.multicall when a command changes the connection list
Disconnecting a peer frees it and reorders the list, so the iteration cannot continue.
2026-09-20 14:05:49 +02:00
xirvik d334b8d339 Stop printing a strerror of si_errno in the SIGBUS dump
Linux leaves si_errno zero there, so the line always read Error: Success.
2026-09-20 10:05:55 +02:00
xirvik 19b71a98b7 Fix data race reading the log buffer from the display thread
Copy entries under the buffer lock before rendering; other threads mutate the deque.
2026-09-20 09:42:59 +02:00
xirvik 8ee3b984dd Give network.xmlrpc.size_limit.set a floor
A limit below any valid request rejects the request that would raise it again.
2026-09-20 09:23:12 +02:00
xirvik 4e7129c71c Keep starting when the DHT cache file is rejected
The router could throw while loading it, stopping rtorrent from starting at all.
2026-09-20 08:53:34 +02:00
xirvik 80ae6a4590 Answer an oversized RPC response with a fault
Cap XML-RPC and JSON-RPC output at the SCGI response limit before handing it over.
2026-09-19 18:04:09 +02:00
xirvik 2086e8e780 Check the argument count before indexing config comment log args
A '# do:log.add_output=debug' line read args[1] past the end of the vector.
2026-09-19 12:13:43 +02:00
xirvik d9439d7a95 Dispatch view.event_added over the added half of the changed range
fb75510 pointed it at the removed half, so it fired on departing downloads instead.
2026-09-19 11:41:58 +02:00
noctuum 0d3404576a Reject a throttle rate that overflows
rate * 1024 wraps to zero at 2^54, which means no limit.
2026-09-19 11:11:00 +02:00
noctuum 84a0d86f2c Own the fault string in xmlrpc_error_c
xmlrpc_env_set_fault frees the buffer the pointer came from.
2026-09-19 10:34:46 +02:00
noctuum 1b15b7c518 Report a failed write in log.vmmap.dump
The dump is only flushed at fclose, whose result was discarded.
2026-09-19 10:11:23 +02:00
noctuum b1be898ba1 Reject an over-long or empty object_storage key
key_type stores a key of key_size or longer as the empty key.
2026-09-18 16:54:48 +02:00
Jari Sundell bd00b5f6fe Use explicit device name binding rather than a custom syntax. 2026-09-18 23:19:43 +09:00
noctuum b34eb1e895 Own the download factory until commit
A malformed data uri threw before commit, and nothing deleted it.
2026-09-18 11:24:30 +02:00
noctuum b857acd081 Increment d.state_counter on pause
The start path increments it; the pause path assigned it to itself.
2026-09-18 11:05:31 +02:00
noctuum 988aca1281 Release the scgi task buffer on close
clear() keeps the capacity, and the task is pooled until exit.
2026-09-18 10:53:58 +02:00
noctuum 378c7ee854 Reject a throttle rate that does not parse
A discarded parse result left the rate at zero, which is unlimited.
2026-09-18 10:37:14 +02:00
noctuum da9606bfae Take ownership of the magnet metadata object
Nothing freed the bencode map the meta download built.
2026-09-18 10:17:28 +02:00
noctuum 8423803b6e Check the flush on the dht cache and history
good() ran before close(), so a failed write replaced the file.
2026-09-17 16:13:55 +02:00
noctuum c1ce2febf0 Reject an over-long line instead of truncating
getline sets failbit, which both loops read as end of input.
2026-09-17 11:33:44 +02:00
noctuum 5ebb7bd151 Call the target deleter in the tinyxml2 backend
A tracker target allocates, and the deleter went out of scope unused.
2026-09-17 10:33:45 +02:00
noctuum 50f0cad0c6 Release the xmlrpc array item on a throw
xmlrpc_to_target throws for an invalid target, skipping the DECREF.
2026-09-17 10:14:21 +02:00
noctuum 3717649bb3 Guard the value iterator in method.insert.list
The list branch dereferenced end() when no value was given.
2026-09-17 09:54:14 +02:00
noctuum c32b56e9d8 Do not reschedule a deleted scheduler item
schedule.remove from the scheduled command deletes the item.
2026-09-16 11:37:19 +02:00
noctuum de54a4c2ad Clamp the negative width in wstring_width
A narrow terminal makes the file list width go below zero.
2026-09-16 11:18:54 +02:00
noctuum 26fdca8f4d Use empty_visible in the view focus movers
empty() counts filtered entries, so size() - 1 underflows.
2026-09-16 10:57:25 +02:00
noctuum 00bcdaee23 Check the info-hash target in p.call_target
Without it an unknown info-hash segfaults the process.
2026-09-16 10:29:52 +02:00
rakshasa 3787dbe7f3 Tagged release 0.16.23. v0.16.23 2026-09-15 14:49:21 +02:00
noctuum 282c86597a Fix a use after free in the xmlrpc-c index path
The string was freed before it was tested, and tmp was never released.
2026-09-14 11:32:11 +02:00
noctuum c41e63248a Check the flush and sync on session file writes
good() was checked before close(), where the data is actually flushed.
2026-09-14 11:10:12 +02:00
noctuum 641626029a Fix a one byte write past address_copy
The index bound was the buffer size, not the last writable index.
2026-09-14 10:53:12 +02:00
noctuum 0c507c581f Release the zlib deflate state in gzip_compress_to_vector.
deflateEnd was never called, leaking 168 kB per compressed response.
2026-09-13 10:43:16 +02:00
noctuum af0b600b54 Add unit tests for ipv4_range_parse.
Covers single addresses, explicit ranges and the cidr mask boundaries.
2026-09-13 10:05:39 +02:00
noctuum c984a69fd1 Fix cidr /32 ip filter entries covering everything above the address.
Shifting end_mask by the full type width is undefined behavior.
2026-09-13 10:05:39 +02:00
Jakob Breivik Grimstveit 20002ce937 Fix false invalid session error on empty URI
Avoid triggering 'Session data is invalid' when loading downloads with an empty URI.
2026-09-11 12:05:59 +02:00
rakshasa 3caa31113d Bumped scgi max content length to 64mb. 2026-09-06 14:50:19 +02:00
Nicolas PARLANT 0373d227c1 add missing headers for libcxx-23
Signed-off-by: Nicolas PARLANT <nicolas.parlant@parhuet.fr>
2026-09-03 09:59:12 +02:00
rakshasa a8be7e443a Tagged release 0.16.22. v0.16.22 2026-09-02 09:39:57 +02:00
aeiouaeiouaeiouaeiouaeiouaeiou f327523a07 gzip.h: fix build with Clang <17
Signed-off-by: aeiouaeiouaeiouaeiouaeiouaeiou <aeioudev@outlook.com>
2026-08-30 11:18:25 +02:00
Jari Sundell 2804be2c9c Optionally sanitize download and file names by replacing slash with underscore. 2026-08-29 18:31:16 +09:00
noctuum 21019fde41 Add the download to the stopped view when a hash check contradicts d.complete.
Setting d.state alone left it in the started view, where d.start cannot restore it.
2026-08-28 09:31:55 +02:00
noctuum e4e858cc40 Stop the download in close_directly() rather than leaving the state behind.
It closed the files while d.state and the started view still called it running.
2026-08-28 09:31:55 +02:00
noctuum 60eb8f0383 Split the file closing in DownloadList::close_directly() into close_files().
Callers that only need the files released should not depend on how a stop behaves.
2026-08-28 09:31:55 +02:00
Jari Sundell 072cbae0c6 Expose system.files.close_idle for FileManager idle FD timeout by @j-c-m 2026-08-28 03:18:25 +09:00
xirvik 16bfaf2694 Reject an XMLRPC size limit above the SCGI content size limit. 2026-08-27 10:48:26 +02:00
xirvik c8da93bd30 Warn that pieces.sync.timeout_safe.set is no longer supported. 2026-08-26 11:21:14 +02:00