#1186: crash by maliciously-crafted .torrent files w/piece length of zero

diff --git a/libtransmission/metainfo.c b/libtransmission/metainfo.c
index 8531f37d5b1d6a2b9b5766b4b828f4b318cb7127..9e82f70b3ec394e5c410edd05d4e82c3995136b3 100644 (file)
--- a/libtransmission/metainfo.c
+++ b/libtransmission/metainfo.c
@@ -411,7 +411,7 @@ tr_metainfoParse( const tr_handle  * handle,
         goto fail;
     }
 
-    if( !inf->fileCount || !inf->totalSize )
+    if( !inf->fileCount || !inf->totalSize || !inf->pieceSize )
     {
         tr_nerr( inf->name, _( "Torrent is corrupt" ) ); /* the content is missing! */
         goto fail;