pidgin/pidgin

Fix TALOS-CAN-0134
release-2.x.y
2016-06-02, Andrew Victor
abdc3025f6b8
Parents 5e5e84e8a798
Children cae95839afeb
Fix TALOS-CAN-0134
--- a/libpurple/protocols/mxit/formcmds.c Sun May 15 05:41:39 2016 -0300
+++ b/libpurple/protocols/mxit/formcmds.c Thu Jun 02 13:24:09 2016 -0500
@@ -519,9 +519,9 @@
const char* tmp;
const char* name;
int mode;
- int nr_columns = 0, nr_rows = 0;
+ unsigned int nr_columns = 0, nr_rows = 0;
gchar** coldata;
- int i, j;
+ unsigned int i, j;
/* table name */
name = g_hash_table_lookup(hash, "nm");
@@ -542,6 +542,12 @@
tmp = g_hash_table_lookup(hash, "d");
coldata = g_strsplit(tmp, "~", 0); /* split into entries for each row & column */
+ if (g_strv_length(coldata) != (nr_rows * nr_columns)) {
+ purple_debug_info(MXIT_PLUGIN_ID, "Invalid table data: cols=%i rows=%i\n", nr_columns, nr_rows);
+ g_strfreev(coldata);
+ return;
+ }
+
purple_debug_info(MXIT_PLUGIN_ID, "Table %s from %s: [cols=%i rows=%i mode=%i]\n", name, mx->from, nr_columns, nr_rows, mode);
for (i = 0; i < nr_rows; i++) {
@@ -549,6 +555,8 @@
purple_debug_info(MXIT_PLUGIN_ID, " Row %i Column %i = %s\n", i, j, coldata[i*nr_columns + j]);
}
}
+
+ g_strfreev(coldata);
}