Fix s24s stats to ensure no unallocated vector is dereferenced. Drive-by fix for the ip= scanner in the http parser

3 files changed, 17 insertions, 2 deletions

diff --git a/src/ot_http.c b/src/ot_http.c
index 1b5281c..262936e 100644
--- a/src/ot_http.c
+++ b/src/ot_http.c
@@ -692,8 +692,10 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
     {
       char *tmp_buf1 = ws->reply, *tmp_buf2 = ws->reply + 16;
       len           = urlencoded_parse(&read_ptr, tmp_buf2, ws->outbuf + G_OUTBUF_SIZE, SCAN_SEARCHPATH_VALUE);
+      if (len <= 0)
+        HTTPERROR_400_PARAM;
       tmp_buf2[len] = 0;
-      if ((len <= 0) || ip_parse(tmp_buf2, tmp_buf1) != (size_t)len)
+      if (ip_parse(tmp_buf2, tmp_buf1) != (size_t)len)
         HTTPERROR_400_PARAM;
       OT_SETIP(&ws->peer, tmp_buf1);
     } break;
diff --git a/src/ot_stats.c b/src/ot_stats.c
index c50d4e3..9e2eabe 100644
--- a/src/ot_stats.c
+++ b/src/ot_stats.c
@@ -244,9 +244,13 @@ static void stats_slash24s_txt(char **reply, const char *reply_end, size_t amoun
     ot_vector *torrents_list = mutex_bucket_lock(bucket);
     for (i = 0; i < torrents_list->size; ++i) {
       ot_peerlist *peer_list   = (((ot_torrent *)(torrents_list->data))[i]).peer_list4;
-      ot_vector   *bucket_list = &peer_list->peers;
+      ot_vector   *bucket_list;
       int          num_buckets = 1;
 
+      if (!peer_list)
+        continue;
+      bucket_list = &peer_list->peers;
+
       if (OT_PEERLIST_HASBUCKETS(peer_list)) {
         num_buckets = bucket_list->size;
         bucket_list = (ot_vector *)bucket_list->data;
diff --git a/tests/integration/test_stats.py b/tests/integration/test_stats.py
index 088d8a1..c4ac95a 100644
--- a/tests/integration/test_stats.py
+++ b/tests/integration/test_stats.py
@@ -177,6 +177,15 @@ class StatsNetworks(TrackerTestCase):
         for line in lines:
             self.assertEqual(int(line.split(b":")[0]), 3, "three peers from the one network")
 
+    def test_the_report_survives_a_torrent_with_no_v4_peers(self):
+        # A torrent whose only peer is v6 has no v4 peer list once the lists
+        # are allocated on demand. The s24 report walks the v4 list of every
+        # torrent, so it has to skip the absent one rather than follow a null
+        # pointer. Needs WANT_IP_FROM_QUERY_STRING to force the family; without
+        # it the peer is loopback v4 and the walk is never asked to skip.
+        self.tracker.announce(self.hash_for("s24v6only"), ip="2001:db8::1", port=6001, left=0)
+        self.assertIn(b"Networks, limit /24:", self.tracker.stats("s24s"))
+
 
 if __name__ == "__main__":
     unittest.main()