Potential buffer overrun on incorrect database

[sorokin]

libtorrent-rasterbar uses quite outdated version of GeoIP. This version has GeoIP_country_code array of size 253 (it doesn't know "BQ", "SS" and "O1"). I assume my database version is up-to-date and it has 256 countries. I've got buffer overrun once http://code.google.com/p/libtorrent/issues/detail?id=720&sort=-id because GeoIP tried to access to index 253 (immediately past the end).

I believe libtorrent should be upgraded to a newer version of GeoIP. But after a bit reading of latest version I still don't see clearly why it can not access past the end of array if database is corrupt. E.g. why function _GeoIP_seek_record_gl could not return value >= 256.

[oschwald]

Thanks for the report. The database format limits the number of countries to 256, but I think you are right that given how the code is written, it is possible for _GeoIP_seek_record_gl to return a value over 255 that would be used in a country array lookup. All of the array country code array lookups should probably be done using these two functions rather than directly.

[sorokin]

All of the array country code array lookups should probably be done using these two functions rather than directly.

Another possibility is a sanity checking and an error reporting if database is corrupted at time of load. But I'm afraid this will require major rewrite.

[oschwald]

Yeah, although more sanity checking would be great, I don't know if significant code changes are likely to happen given that this is a legacy API and our development is focused on libmaxminddb.

[oschwald]

This was fixed in #54.