Attachment 24979 Details for Bug 62226

[patch] gaim-1.0.1-msn-security_fixes.patch

gaim-1.0.1-msn-security_fixes.patch (text/plain), 2.60 KB, created by Ludwig Nussel on 2004-10-14 19:16:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2004-10-14 19:16:25 UTC

Size: 2.60 KB

patch

obsolete

>diff -pur gaim-1.0.1/src/protocols/msn/slplink.c gaim-cvs.oldstatus/src/protocols/msn/slplink.c
>--- gaim-1.0.1/src/protocols/msn/slplink.c	2004-08-24 21:45:41.000000000 -0400
>+++ gaim-cvs.oldstatus/src/protocols/msn/slplink.c	2004-10-13 10:17:42.000000000 -0400
>@@ -447,7 +447,6 @@ msn_slplink_process_msg(MsnSlpLink *slpl
> 		slpmsg->session_id = msg->msnslp_header.session_id;
> 		slpmsg->size = msg->msnslp_header.total_size;
> 		slpmsg->flags = msg->msnslp_header.flags;
>-		slpmsg->buffer = g_malloc(slpmsg->size);
> 
> 		if (slpmsg->session_id)
> 		{
>@@ -471,10 +470,19 @@ msn_slplink_process_msg(MsnSlpLink *slpl
> 				}
> 			}
> 		}
>+		if (!slpmsg->fp)
>+		{
>+			slpmsg->buffer = g_try_malloc(slpmsg->size);
>+			if (slpmsg->buffer == NULL)
>+			{
>+				gaim_debug_error("msn", "Failed to allocate buffer for slpmsg\n");
>+				return;
>+			}
>+		}
> 	}
> 	else
> 	{
>-		slpmsg = msn_slplink_message_find(slplink, msg->msnslp_header.id);
>+		slpmsg = msn_slplink_message_find(slplink, msg->msnslp_header.session_id, msg->msnslp_header.id);
> 	}
> 
> 	if (slpmsg != NULL)
>@@ -486,7 +494,13 @@ msn_slplink_process_msg(MsnSlpLink *slpl
> 		}
> 		else
> 		{
>-			memcpy(slpmsg->buffer + offset, data, len);
>+			if ((offset + len) > slpmsg->size)
>+			{
>+				gaim_debug_error("msn", "Oversized slpmsg\n");
>+				g_return_if_reached();
>+			}
>+			else
>+				memcpy(slpmsg->buffer + offset, data, len);
> 		}
> 	}
> 	else
>@@ -544,7 +558,7 @@ msn_slplink_process_msg(MsnSlpLink *slpl
> }
> 
> MsnSlpMessage *
>-msn_slplink_message_find(MsnSlpLink *slplink, long id)
>+msn_slplink_message_find(MsnSlpLink *slplink, long session_id, long id)
> {
> 	GList *e;
> 
>@@ -552,7 +566,7 @@ msn_slplink_message_find(MsnSlpLink *slp
> 	{
> 		MsnSlpMessage *slpmsg = e->data;
> 
>-		if (slpmsg->id == id)
>+		if ((slpmsg->session_id == session_id) && (slpmsg->id == id))
> 			return slpmsg;
> 	}
> 
>diff -pur gaim-1.0.1/src/protocols/msn/slplink.h gaim-cvs.oldstatus/src/protocols/msn/slplink.h
>--- gaim-1.0.1/src/protocols/msn/slplink.h	2004-06-05 23:42:54.000000000 -0400
>+++ gaim-cvs.oldstatus/src/protocols/msn/slplink.h	2004-10-13 09:42:37.000000000 -0400
>@@ -70,7 +70,7 @@ void msn_slplink_send_slpmsg(MsnSlpLink 
> void msn_slplink_unleash(MsnSlpLink *slplink);
> void msn_slplink_send_ack(MsnSlpLink *slplink, MsnMessage *msg);
> void msn_slplink_process_msg(MsnSlpLink *slplink, MsnMessage *msg);
>-MsnSlpMessage *msn_slplink_message_find(MsnSlpLink *slplink, long id);
>+MsnSlpMessage *msn_slplink_message_find(MsnSlpLink *slplink, long session_id, long id);
> void msn_slplink_append_slp_msg(MsnSlpLink *slplink, MsnSlpMessage *slpmsg);
> void msn_slplink_remove_slp_msg(MsnSlpLink *slplink,
> 								 MsnSlpMessage *slpmsg);

Actions: View | Diff

Attachments on bug 62226: 24979