gaim/gaim

Fix a leak and some other issues caused by malformed messages.
oldstatus
2005-06-08, Daniel Atallah
b420ba666185
Parents c4609c3a9416
Children 1614de923c43
Fix a leak and some other issues caused by malformed messages.
1 files changed, 26 insertions(+), 12 deletions(-)
  • +26 -12
    src/protocols/msn/msg.c
    • --- a/src/protocols/msn/msg.c Mon Jun 06 18:31:42 2005 -0400
    +++ b/src/protocols/msn/msg.c Wed Jun 08 17:31:20 2005 -0400
    @@ -205,7 +205,10 @@
    /* TODO? some clients use \r delimiters instead of \r\n, the official client
    * doesn't send such messages, but does handle receiving them. We'll just
    * avoid crashing for now */
    - g_return_if_fail(end != NULL);
    + if (end == NULL) {
    + g_free(tmp_base);
    + g_return_if_reached();
    + }
    *end = '\0';
    elems = g_strsplit(tmp, "\r\n", 0);
    @@ -252,6 +255,7 @@
    g_strfreev(elems);
    + /* Proceed to the end of the "\r\n\r\n" */
    tmp = end + 4;
    /* Now we *should* be at the body. */
    @@ -262,6 +266,12 @@
    {
    MsnSlpHeader header;
    MsnSlpFooter footer;
    + int body_len;
    +
    + if (payload_len - (tmp - tmp_base) < sizeof(header)) {
    + g_free(tmp_base);
    + g_return_if_reached();
    + }
    msg->msnslp_message = TRUE;
    @@ -279,24 +289,28 @@
    msg->msnslp_header.ack_sub_id = GUINT32_FROM_LE(header.ack_sub_id);
    msg->msnslp_header.ack_size = GUINT64_FROM_LE(header.ack_size);
    - /* Import the body. */
    - msg->body_len = payload_len - (tmp - tmp_base) - sizeof(footer);
    + body_len = payload_len - (tmp - tmp_base) - sizeof(footer);
    - if (msg->body_len > 0)
    + /* Import the body. */
    + if (body_len > 0) {
    + msg->body_len = body_len;
    msg->body = g_memdup(tmp, msg->body_len);
    -
    - tmp += msg->body_len;
    + tmp += body_len;
    + }
    /* Import the footer. */
    - memcpy(&footer, tmp, sizeof(footer));
    - tmp += sizeof(footer);
    -
    - msg->msnslp_footer.value = GUINT32_FROM_BE(footer.value);
    + if (body_len >= 0) {
    + memcpy(&footer, tmp, sizeof(footer));
    + tmp += sizeof(footer);
    + msg->msnslp_footer.value = GUINT32_FROM_BE(footer.value);
    + }
    }
    else
    {
    - msg->body_len = payload_len - (tmp - tmp_base);
    - msg->body = g_memdup(tmp, msg->body_len);
    + if (payload_len - (tmp - tmp_base) > 0) {
    + msg->body_len = payload_len - (tmp - tmp_base);
    + msg->body = g_memdup(tmp, msg->body_len);
    + }
    }
    g_free(tmp_base);