|
Lines 167-179
Link Here
|
| 167 |
* - e - opis zdarzenia |
167 |
* - e - opis zdarzenia |
| 168 |
* - |
168 |
* - |
| 169 |
*/ |
169 |
*/ |
| 170 |
static void gg_image_queue_parse(struct gg_event *e, char *p, int len, struct gg_session *sess, uin_t sender) |
170 |
static void gg_image_queue_parse(struct gg_event *e, char *p, unsigned int len, struct gg_session *sess, uin_t sender) |
| 171 |
{ |
171 |
{ |
| 172 |
struct gg_msg_image_reply *i = (void*) p; |
172 |
struct gg_msg_image_reply *i = (void*) p; |
| 173 |
struct gg_image_queue *q, *qq; |
173 |
struct gg_image_queue *q, *qq; |
| 174 |
|
174 |
|
| 175 |
if (!p || !sess || !e) |
175 |
if (!p || !sess || !e) { |
| 176 |
{ |
|
|
| 177 |
errno = EFAULT; |
176 |
errno = EFAULT; |
| 178 |
return; |
177 |
return; |
| 179 |
} |
178 |
} |
|
Lines 302-308
Link Here
|
| 302 |
|
301 |
|
| 303 |
count = gg_fix32(m->count); |
302 |
count = gg_fix32(m->count); |
| 304 |
|
303 |
|
| 305 |
if (p + count * sizeof(uin_t) > packet_end) { |
304 |
if (p + count * sizeof(uin_t) > packet_end || p + count * sizeof(uin_t) < p || count > 0xffff) { |
| 306 |
gg_debug(GG_DEBUG_MISC, "// gg_handle_recv_msg() packet out of bounds (1.5)\n"); |
305 |
gg_debug(GG_DEBUG_MISC, "// gg_handle_recv_msg() packet out of bounds (1.5)\n"); |
| 307 |
goto malformed; |
306 |
goto malformed; |
| 308 |
} |
307 |
} |
|
Lines 312-319
Link Here
|
| 312 |
goto fail; |
311 |
goto fail; |
| 313 |
} |
312 |
} |
| 314 |
|
313 |
|
| 315 |
for (i = 0; i < count; i++, p += sizeof(uin_t)) |
314 |
for (i = 0; i < count; i++, p += sizeof(uint32_t)) { |
| 316 |
e->event.msg.recipients[i] = gg_fix32(*((uint32_t*) p)); |
315 |
uint32_t u; |
|
|
316 |
memcpy(&u, p, sizeof(uint32_t)); |
| 317 |
e->event.msg.recipients[i] = gg_fix32(u); |
| 318 |
} |
| 317 |
|
319 |
|
| 318 |
e->event.msg.recipients_count = count; |
320 |
e->event.msg.recipients_count = count; |
| 319 |
|
321 |
|
|
Lines 322-328
Link Here
|
| 322 |
|
324 |
|
| 323 |
case 0x02: /* richtext */ |
325 |
case 0x02: /* richtext */ |
| 324 |
{ |
326 |
{ |
| 325 |
unsigned short len; |
327 |
uint16_t len; |
| 326 |
char *buf; |
328 |
char *buf; |
| 327 |
|
329 |
|
| 328 |
if (p + 3 > packet_end) { |
330 |
if (p + 3 > packet_end) { |
|
Lines 330-336
Link Here
|
| 330 |
goto malformed; |
332 |
goto malformed; |
| 331 |
} |
333 |
} |
| 332 |
|
334 |
|
| 333 |
len = gg_fix16(*((unsigned short*) (p + 1))); |
335 |
memcpy(&len, p + 1, sizeof(uint16_t)); |
|
|
336 |
len = gg_fix16(len); |
| 334 |
|
337 |
|
| 335 |
if (!(buf = malloc(len))) { |
338 |
if (!(buf = malloc(len))) { |
| 336 |
gg_debug(GG_DEBUG_MISC, "// gg_handle_recv_msg() not enough memory for richtext data\n"); |
339 |
gg_debug(GG_DEBUG_MISC, "// gg_handle_recv_msg() not enough memory for richtext data\n"); |
|
Lines 394-400
Link Here
|
| 394 |
goto malformed; |
399 |
goto malformed; |
| 395 |
} |
400 |
} |
| 396 |
|
401 |
|
| 397 |
gg_image_queue_parse(e, p, (int)(packet_end - p), sess, gg_fix32(r->sender)); |
402 |
rep->size = gg_fix32(rep->size); |
|
|
403 |
rep->crc32 = gg_fix32(rep->crc32); |
| 404 |
gg_image_queue_parse(e, p, (unsigned int)(packet_end - p), sess, gg_fix32(r->sender)); |
| 398 |
|
405 |
|
| 399 |
return 0; |
406 |
return 0; |
| 400 |
} |
407 |
} |
|
Lines 471-477
Link Here
|
| 471 |
case GG_NOTIFY_REPLY: |
478 |
case GG_NOTIFY_REPLY: |
| 472 |
{ |
479 |
{ |
| 473 |
struct gg_notify_reply *n = (void*) p; |
480 |
struct gg_notify_reply *n = (void*) p; |
| 474 |
int count, i; |
481 |
unsigned int count, i; |
| 475 |
char *tmp; |
482 |
char *tmp; |
| 476 |
|
483 |
|
| 477 |
gg_debug(GG_DEBUG_MISC, "// gg_watch_fd_connected() received a notify reply\n"); |
484 |
gg_debug(GG_DEBUG_MISC, "// gg_watch_fd_connected() received a notify reply\n"); |
|
Lines 482-488
Link Here
|
| 482 |
goto fail; |
489 |
goto fail; |
| 483 |
} |
490 |
} |
| 484 |
|
491 |
|
| 485 |
if (gg_fix32(n->status) == GG_STATUS_BUSY_DESCR || gg_fix32(n->status == GG_STATUS_NOT_AVAIL_DESCR) || gg_fix32(n->status) == GG_STATUS_AVAIL_DESCR) { |
492 |
if (gg_fix32(n->status) == GG_STATUS_BUSY_DESCR || gg_fix32(n->status) == GG_STATUS_NOT_AVAIL_DESCR || gg_fix32(n->status) == GG_STATUS_AVAIL_DESCR) { |
| 486 |
e->type = GG_EVENT_NOTIFY_DESCR; |
493 |
e->type = GG_EVENT_NOTIFY_DESCR; |
| 487 |
|
494 |
|
| 488 |
if (!(e->event.notify_descr.notify = (void*) malloc(sizeof(*n) * 2))) { |
495 |
if (!(e->event.notify_descr.notify = (void*) malloc(sizeof(*n) * 2))) { |
|
Lines 493-498
Link Here
|
| 493 |
memcpy(e->event.notify_descr.notify, p, sizeof(*n)); |
500 |
memcpy(e->event.notify_descr.notify, p, sizeof(*n)); |
| 494 |
e->event.notify_descr.notify[0].uin = gg_fix32(e->event.notify_descr.notify[0].uin); |
501 |
e->event.notify_descr.notify[0].uin = gg_fix32(e->event.notify_descr.notify[0].uin); |
| 495 |
e->event.notify_descr.notify[0].status = gg_fix32(e->event.notify_descr.notify[0].status); |
502 |
e->event.notify_descr.notify[0].status = gg_fix32(e->event.notify_descr.notify[0].status); |
|
|
503 |
e->event.notify_descr.notify[0].remote_ip = e->event.notify_descr.notify[0].remote_ip; |
| 496 |
e->event.notify_descr.notify[0].remote_port = gg_fix16(e->event.notify_descr.notify[0].remote_port); |
504 |
e->event.notify_descr.notify[0].remote_port = gg_fix16(e->event.notify_descr.notify[0].remote_port); |
| 497 |
|
505 |
|
| 498 |
count = h->length - sizeof(*n); |
506 |
count = h->length - sizeof(*n); |
|
Lines 519-525
Link Here
|
| 519 |
for (i = 0; i < count; i++) { |
527 |
for (i = 0; i < count; i++) { |
| 520 |
e->event.notify[i].uin = gg_fix32(e->event.notify[i].uin); |
528 |
e->event.notify[i].uin = gg_fix32(e->event.notify[i].uin); |
| 521 |
e->event.notify[i].status = gg_fix32(e->event.notify[i].status); |
529 |
e->event.notify[i].status = gg_fix32(e->event.notify[i].status); |
| 522 |
e->event.notify[i].remote_port = gg_fix16(e->event.notify[i].remote_port); |
530 |
e->event.notify[i].remote_ip = e->event.notify[i].remote_ip; |
|
|
531 |
e->event.notify[i].remote_port = gg_fix16(e->event.notify[i].remote_port); |
| 523 |
} |
532 |
} |
| 524 |
} |
533 |
} |
| 525 |
|
534 |
|
|
Lines 653-660
Link Here
|
| 653 |
|
669 |
|
| 654 |
e->event.status60.descr = buf; |
670 |
e->event.status60.descr = buf; |
| 655 |
|
671 |
|
| 656 |
if (len > 4 && p[h->length - 5] == 0) |
672 |
if (len > 4 && p[h->length - 5] == 0) { |
| 657 |
e->event.status60.time = *((int*) (p + h->length - 4)); |
673 |
uint32_t t; |
|
|
674 |
memcpy(&t, p + h->length - 4, sizeof(uint32_t)); |
| 675 |
e->event.status60.time = gg_fix32(t); |
| 676 |
} |
| 658 |
} |
677 |
} |
| 659 |
|
678 |
|
| 660 |
break; |
679 |
break; |
|
Lines 720-726
Link Here
|
| 720 |
|
739 |
|
| 721 |
if (h->length > 1) { |
740 |
if (h->length > 1) { |
| 722 |
char *tmp; |
741 |
char *tmp; |
| 723 |
int len = (sess->userlist_reply) ? strlen(sess->userlist_reply) : 0; |
742 |
unsigned int len = (sess->userlist_reply) ? strlen(sess->userlist_reply) : 0; |
| 724 |
|
743 |
|
| 725 |
gg_debug(GG_DEBUG_MISC, "userlist_reply=%p, len=%d\n", sess->userlist_reply, len); |
744 |
gg_debug(GG_DEBUG_MISC, "userlist_reply=%p, len=%d\n", sess->userlist_reply, len); |
| 726 |
|
745 |
|