Bugzilla – Attachment 22902 Details for
Bug 59194
VUL-0: CVE-2004-2589: new gaim issues
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
IDP Log In
|
Forgot Password
[patch]
patch for 0.75 (9.1)
44194-0.75.diff (text/plain), 4.17 KB, created by
Ludwig Nussel
on 2004-08-25 21:11:00 UTC
(
hide
)
Description:
patch for 0.75 (9.1)
Filename:
MIME Type:
Creator:
Ludwig Nussel
Created:
2004-08-25 21:11:00 UTC
Size:
4.17 KB
patch
obsolete
>Index: gaim-0.75/src/protocols/zephyr/ZInit.c >=================================================================== >--- gaim-0.75.orig/src/protocols/zephyr/ZInit.c >+++ gaim-0.75/src/protocols/zephyr/ZInit.c >@@ -32,7 +32,7 @@ Code_t ZInitialize() > { > struct servent *hmserv; > struct hostent *hostent; >- char addr[4], hostname[MAXHOSTNAMELEN]; >+ char addr[4], hostname[MAXHOSTNAMELEN+1]; > struct in_addr servaddr; > struct sockaddr_in sin; > int s, sinsize = sizeof(sin); >@@ -134,6 +134,7 @@ Code_t ZInitialize() > * is a pretty broken thing to do, and unfortunately what we > * always do on server machines.) */ > if (gethostname(hostname, sizeof(hostname)) == 0) { >+ hostname[sizeof(hostname)-1] = '\0'; > hostent = gethostbyname(hostname); > if (hostent && hostent->h_addrtype == AF_INET) > memcpy(&__My_addr, hostent->h_addr, sizeof(__My_addr)); >Index: gaim-0.75/src/util.c >=================================================================== >--- gaim-0.75.orig/src/util.c >+++ gaim-0.75/src/util.c >@@ -2133,14 +2133,30 @@ parse_redirect(const char *data, size_t > static size_t > parse_content_len(const char *data, size_t data_len) > { >- int content_len = 0; >- char *tmp; >+ size_t content_len = 0; >+ const char *p = NULL; > >- tmp = g_malloc(data_len + 1); >- memcpy(tmp, data, data_len); >- tmp[data_len] = '\0'; >- sscanf(tmp, "Content-Length: %d", &content_len); >- g_free(tmp); >+ /* This is still technically wrong, since headers are case-insensitive >+ * [RFC 2616, section 4.2], though this ought to catch the normal case. >+ * Note: data is _not_ nul-terminated. >+ */ >+ if (data_len > 16) { >+ p = strncmp(data, "Content-Length: ", 16) == 0? data: NULL; >+ if (!p) { >+ p = g_strstr_len(data, data_len, "\nContent-Length: "); >+ if (p) >+ p += 1; >+ } >+ } >+ >+ /* If we can find a Content-Length header at all, try to sscanf it. >+ * Response headers should end with at least \r\n, so sscanf is safe, >+ * if we make sure that there is indeed a \n in our header. >+ */ >+ if (p && g_strstr_len(p, data_len - (p - data), "\n")) { >+ sscanf(p, "Content-Length: %u", (int *)&content_len); >+ gaim_debug_misc("parse_content_len", "parsed %u\n", content_len); >+ } > > return content_len; > } >@@ -2271,7 +2287,15 @@ url_fetched_cb(gpointer url_data, gint s > > /* In with the new. */ > gfud->data_len = content_len; >- gfud->webdata = g_malloc(gfud->data_len); >+ gfud->webdata = g_try_malloc(gfud->data_len); >+ if (gfud->webdata == NULL) { >+ gaim_debug_error("gaim_url_fetch", "Failed to allocate %u bytes: %s\n", gfud->data_len, strerror(errno)); >+ gaim_input_remove(gfud->inpa); >+ close(sock); >+ gfud->callback(gfud->user_data, NULL, 0); >+ destroy_fetch_url_data(gfud); >+ } >+ > } > else > gfud->newline = TRUE; >@@ -2349,7 +2373,7 @@ gaim_url_decode(const char *str) > > g_return_val_if_fail(str != NULL, NULL); > >- for (i = 0; i < strlen(str); i++) { >+ for (i = 0; i < strlen(str) && j < sizeof(buf)-2; i++) { > char hex[3]; > > if (str[i] != '%') >@@ -2386,9 +2410,12 @@ gaim_url_encode(const char *str) > g_return_val_if_fail(str != NULL, NULL); > > for (i = 0; i < strlen(str); i++) { >- if (isalnum(str[i])) >+ if (isalnum(str[i])) { >+ if(j+1 >= sizeof(buf)-1) break; > buf[j++] = str[i]; >+ } > else { >+ if(j+3 >= sizeof(buf)-1) break; > sprintf(buf + j, "%%%02x", (unsigned char)str[i]); > j += 3; > } >Index: gaim-0.75/src/gtkprefs.c >=================================================================== >--- gaim-0.75.orig/src/gtkprefs.c >+++ gaim-0.75/src/gtkprefs.c >@@ -438,7 +438,7 @@ GtkTreePath *theme_refresh_theme_list() > > void theme_install_theme(char *path, char *extn) { > #ifndef _WIN32 >- gchar *command; >+ gchar *command, *escaped; > #endif > gchar *destdir; > gchar *tail; >@@ -458,7 +458,9 @@ void theme_install_theme(char *path, cha > * other platforms, if need be */ > if (!g_ascii_strcasecmp(tail, ".gz") || !g_ascii_strcasecmp(tail, ".tgz")) { > #ifndef _WIN32 >- command = g_strdup_printf("tar > /dev/null xzf \"%s\" -C %s", path, destdir); >+ escaped = g_shell_quote(path); >+ command = g_strdup_printf("tar > /dev/null xzf %s -C %s", escaped, destdir); >+ g_free(escaped); > #else > if(!wgaim_gz_untar(path, destdir)) { > g_free(destdir);
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
Actions:
View
|
Diff
Attachments on
bug 59194
:
22895
|
22896
|
22899
|
22900
| 22902 |
22904