pidgin/pidgin

Use the more robust entity processing that @dequisdequis came up with
EionRobb/fix-for-crash-when-sending-invalid-xml-e-1487474010880
2017-02-20, Eion Robb
b2fc9e774cb9
Parents 6745ecd124da
Children e85451478ebe1dd6aec66edb
Use the more robust entity processing that @dequisdequis came up with
1 files changed, 20 insertions(+), 9 deletions(-)
  • +20 -9
    libpurple/util.c
    • --- a/libpurple/util.c Sun Feb 19 03:13:47 2017 +0000
    +++ b/libpurple/util.c Mon Feb 20 21:05:32 2017 +0000
    @@ -978,18 +978,29 @@
    pln = "\302\256"; /* or use g_unichar_to_utf8(0xae); */
    else if(IS_ENTITY("'"))
    pln = "\'";
    - else if(*(text+1) == '#' &&
    - (sscanf(text, "&#%*[^ ]%u%1[;]", &pound, temp) == 2 ||
    - sscanf(text, "&#x%*[^ ]%x%1[;]", &pound, temp) == 2) &&
    - pound != 0) {
    + else if(text[1] == '#' && g_ascii_isxdigit(text[2])) {
    static char buf[7];
    - int buflen = g_unichar_to_utf8((gunichar)pound, buf);
    + const char *start = text + 2;
    + char *end;
    + guint64 pound;
    + int base = 10;
    + int buflen;
    +
    + if (*start == 'x') {
    + base = 16;
    + start++;
    + }
    +
    + pound = g_ascii_strtoull(start, &end, base);
    + if (pound == 0 || pound > INT_MAX || *end != ';') {
    + return NULL;
    + }
    +
    + len = (end - text) + 1;
    +
    + buflen = g_unichar_to_utf8((gunichar)pound, buf);
    buf[buflen] = '\0';
    pln = buf;
    -
    - len = (*(text+2) == 'x' ? 3 : 2);
    - while(isxdigit((gint) text[len])) len++;
    - if(text[len] == ';') len++;
    }
    else
    return NULL;