Attachment 22614 Details for Bug 56630

[patch] The fix for SL 9.1 (gaim-0.75)

gaim-0.75-msn-security4.dif (text/plain), 2.43 KB, created by Sebastian Krahmer on 2004-08-09 17:47:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2004-08-09 17:47:13 UTC

Size: 2.43 KB

patch

obsolete

>--- servconn.c.orig	2003-12-26 17:37:33.000000000 -0800
>+++ servconn.c	2004-08-06 18:18:46.000000000 -0700
>@@ -146,7 +146,7 @@
> 
> 	if (servconn->multiline_type == MSN_MULTILINE_MSG) {
> 		MsnMessage *msg;
>-		size_t header_len;
>+		size_t header_len, left;
> 
> 		g_snprintf(msg_str, sizeof(msg_str),
> 				   "MSG %s %s %d\r\n",
>@@ -154,8 +154,18 @@
> 				   servconn->multiline_len);
> 
> 		header_len = strlen(msg_str);
>+		left = sizeof(msg_str) - header_len;
>+		if (left > servconn->multiline_len)
>+			left = servconn->multiline_len;
> 
>-		memcpy(msg_str + header_len, buffer, servconn->multiline_len);
>+		if (left != servconn->multiline_len) {
>+			g_snprintf(msg_str, sizeof(msg_str),
>+				   "MSG %s %s %d\r\n",
>+				   servconn->msg_passport, servconn->msg_friendly,
>+				   left);
>+			header_len = strlen(msg_str);
>+		}
>+		memcpy(msg_str + header_len, buffer, left);
> 
> 		gaim_debug(GAIM_DEBUG_MISC, "msn",
> 				   "Message: {%s}\n", buffer);
>@@ -654,3 +664,4 @@
> 		}
> 	}
> }
>+
>--- msnslp.c.orig	2003-11-22 19:23:02.000000000 -0800
>+++ msnslp.c	2004-06-26 05:23:23.000000000 -0700
>@@ -224,13 +224,17 @@
> 			/* It's not valid. Kill this off. */
> 			char temp[32];
> 			const char *c;
>+			size_t offset;
> 
>+			memset(temp, 0, sizeof(temp));
> 			/* Eww */
> 			if ((c = strchr(status, '\r')) || (c = strchr(status, '\n')) ||
> 				(c = strchr(status, '\0')))
> 			{
>-				strncpy(temp, status, c - status);
>-				temp[c - status] = '\0';
>+				offset = c - status;
>+				if (offset >= sizeof(temp))
>+					offset = sizeof(temp) - 1;
>+				strncpy(temp, status, offset);
> 			}
> 
> 			gaim_debug_error("msn", "Received non-OK result: %s\n", temp);
>--- msg.c.orig	2003-12-12 22:19:56.000000000 -0800
>+++ msg.c	2004-06-26 05:26:14.000000000 -0700
>@@ -257,7 +257,8 @@
> 
> 		msg->msnslp_message = TRUE;
> 
>-		memcpy(header, tmp, 48);
>+		memset(header, 0, sizeof(header));
>+		memcpy(header, tmp, sizeof(header)-1);
> 
> 		tmp += 48;
> 
>@@ -901,4 +902,3 @@
> 
> 	return table;
> }
>
>--- msnobject.c.orig	2004-08-07 23:59:41.000000000 -0700
>+++ msnobject.c	2004-08-08 00:04:51.000000000 -0700
>@@ -34,11 +34,16 @@
> 	if ((tag = strstr(str, id "=\"")) != NULL) \
> 	{ \
> 		char buf[16]; \
>+		size_t offset; \
> 		tag += strlen(id "=\""); \
> 		c = strchr(tag, '"'); \
> 		if (c != NULL) \
> 		{ \
>-			strncpy(buf, tag, c - tag); \
>+			memset(buf, 0, sizeof(buf)); \
>+			offset = c - tag; \
>+			if (offset >= sizeof(buf)) \
>+				offset = sizeof(buf) - 1; \
>+			strncpy(buf, tag, offset); \
> 			obj->field = atoi(buf); \
> 		} \
> 	}

Actions: View | Diff

Attachments on bug 56630: 21723 | 22258 | 22553 | 22593 | 22613 | 22614