Attachment 42706 Details for Bug 97408

[patch] minimal patch

libgadu.diff (text/plain), 10.85 KB, created by Dirk Mueller on 2005-07-20 23:11:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dirk Mueller

Created: 2005-07-20 23:11:40 UTC

Size: 10.85 KB

patch

obsolete

>diff -ur ekg-1.6rc1/lib/common.c ekg-1.6rc3/lib/common.c
>--- ekg-1.6rc1/lib/common.c	2005-03-20 01:43:44.000000000 +0100
>+++ ekg-1.6rc3/lib/common.c	2005-05-23 18:27:15.000000000 +0200
>@@ -294,12 +294,16 @@
>  *  - buf - wska¼nik do bufora
>  *  - length - d³ugo¶æ bufora
>  *
>- * je¶li trafi na b³±d odczytu, zwraca NULL. inaczej zwraca buf.
>+ * je¶li trafi na b³±d odczytu lub podano nieprawid³owe parametry, zwraca NULL.
>+ * inaczej zwraca buf.
>  */
> char *gg_read_line(int sock, char *buf, int length)
> {
> 	int ret;
> 
>+	if (!buf || length < 0)
>+		return NULL;
>+
> 	for (; length > 1; buf++, length--) {
> 		do {
> 			if ((ret = read(sock, buf, 1)) == -1 && errno != EINTR) {
>@@ -360,7 +364,7 @@
> {
> 	char *q, *buf, hex[] = "0123456789abcdef";
> 	const char *p;
>-	int size = 0;
>+	unsigned int size = 0;
> 
> 	if (!str)
> 		str = "";
>@@ -412,18 +416,18 @@
> 	va_start(ap, format);
> 
> 	for (j = 0; j < strlen(format); j++) {
>-		unsigned char *arg, buf[16];
>+		char *arg, buf[16];
> 
> 		if (format[j] == 'u') {
> 			snprintf(buf, sizeof(buf), "%d", va_arg(ap, uin_t));
> 			arg = buf;
> 		} else {
>-			if (!(arg = va_arg(ap, unsigned char*)))
>+			if (!(arg = va_arg(ap, char*)))
> 				arg = "";
> 		}	
> 
> 		i = 0;
>-		while ((c = (int) arg[i++]) != 0) {
>+		while ((c = (unsigned char) arg[i++]) != 0) {
> 			a = (c ^ b) + (c << 8);
> 			b = (a >> 24) | (a << 8);
> 		}
>@@ -613,7 +617,7 @@
> char *gg_base64_encode(const char *buf)
> {
> 	char *out, *res;
>-	int i = 0, j = 0, k = 0, len = strlen(buf);
>+	unsigned int i = 0, j = 0, k = 0, len = strlen(buf);
> 	
> 	res = out = malloc((len / 3 + 1) * 4 + 2);
> 
>@@ -671,7 +675,7 @@
> {
> 	char *res, *save, *foo, val;
> 	const char *end;
>-	int index = 0;
>+	unsigned int index = 0;
> 
> 	if (!buf)
> 		return NULL;
>@@ -765,7 +769,7 @@
> static void gg_crc32_make_table()
> {
> 	uint32_t h = 1;
>-	int i, j;
>+	unsigned int i, j;
> 
> 	memset(gg_crc32_table, 0, sizeof(gg_crc32_table));
> 
>@@ -795,6 +799,9 @@
> 	if (!gg_crc32_initialized)
> 		gg_crc32_make_table();
> 
>+	if (!buf || len < 0)
>+		return crc;
>+
> 	crc ^= 0xffffffffL;
> 
> 	while (len--)
>diff -ur ekg-1.6rc1/lib/dcc.c ekg-1.6rc3/lib/dcc.c
>--- ekg-1.6rc1/lib/dcc.c	2005-03-20 01:43:44.000000000 +0100
>+++ ekg-1.6rc3/lib/dcc.c	2005-05-22 10:41:54.000000000 +0200
>@@ -52,9 +52,9 @@
>  *  - buf - bufor z danymi
>  *  - size - rozmiar danych
>  */
>-static void gg_dcc_debug_data(const char *prefix, int fd, const void *buf, int size)
>+static void gg_dcc_debug_data(const char *prefix, int fd, const void *buf, unsigned int size)
> {
>-	int i;
>+	unsigned int i;
> 	
> 	gg_debug(GG_DEBUG_MISC, "++ gg_dcc %s (fd=%d,len=%d)", prefix, fd, size);
> 	
>diff -ur ekg-1.6rc1/lib/events.c ekg-1.6rc3/lib/events.c
>--- ekg-1.6rc1/lib/events.c	2005-03-20 01:43:44.000000000 +0100
>+++ ekg-1.6rc3/lib/events.c	2005-07-17 17:32:56.000000000 +0200
>@@ -167,13 +167,12 @@
>  *  - e - opis zdarzenia
>  *  - 
>  */
>-static void gg_image_queue_parse(struct gg_event *e, char *p, int len, struct gg_session *sess, uin_t sender)
>+static void gg_image_queue_parse(struct gg_event *e, char *p, unsigned int len, struct gg_session *sess, uin_t sender)
> {
> 	struct gg_msg_image_reply *i = (void*) p;
> 	struct gg_image_queue *q, *qq;
> 
>-	if (!p || !sess || !e)
>-	{
>+	if (!p || !sess || !e) {
> 		errno = EFAULT;
> 		return;
> 	}
>@@ -302,7 +301,7 @@
> 
> 				count = gg_fix32(m->count);
> 
>-				if (p + count * sizeof(uin_t) > packet_end) {
>+				if (p + count * sizeof(uin_t) > packet_end || p + count * sizeof(uin_t) < p || count > 0xffff) {
> 					gg_debug(GG_DEBUG_MISC, "// gg_handle_recv_msg() packet out of bounds (1.5)\n");
> 					goto malformed;
> 				}
>@@ -312,8 +311,11 @@
> 					goto fail;
> 				}
> 			
>-				for (i = 0; i < count; i++, p += sizeof(uin_t))
>-					e->event.msg.recipients[i] = gg_fix32(*((uint32_t*) p));
>+				for (i = 0; i < count; i++, p += sizeof(uint32_t)) {
>+					uint32_t u;
>+					memcpy(&u, p, sizeof(uint32_t));
>+					e->event.msg.recipients[i] = gg_fix32(u);
>+				}
> 				
> 				e->event.msg.recipients_count = count;
> 				
>@@ -322,7 +324,7 @@
> 
> 			case 0x02:		/* richtext */
> 			{
>-				unsigned short len;
>+				uint16_t len;
> 				char *buf;
> 			
> 				if (p + 3 > packet_end) {
>@@ -330,7 +332,8 @@
> 					goto malformed;
> 				}
> 
>-				len = gg_fix16(*((unsigned short*) (p + 1)));
>+				memcpy(&len, p + 1, sizeof(uint16_t));
>+				len = gg_fix16(len);
> 
> 				if (!(buf = malloc(len))) {
> 					gg_debug(GG_DEBUG_MISC, "// gg_handle_recv_msg() not enough memory for richtext data\n");
>@@ -394,7 +399,9 @@
> 					goto malformed;
> 				}
> 
>-				gg_image_queue_parse(e, p, (int)(packet_end - p), sess, gg_fix32(r->sender));
>+				rep->size = gg_fix32(rep->size);
>+				rep->crc32 = gg_fix32(rep->crc32);
>+				gg_image_queue_parse(e, p, (unsigned int)(packet_end - p), sess, gg_fix32(r->sender));
> 
> 				return 0;
> 			}
>@@ -471,7 +478,7 @@
> 		case GG_NOTIFY_REPLY:
> 		{
> 			struct gg_notify_reply *n = (void*) p;
>-			int count, i;
>+			unsigned int count, i;
> 			char *tmp;
> 
> 			gg_debug(GG_DEBUG_MISC, "// gg_watch_fd_connected() received a notify reply\n");
>@@ -482,7 +489,7 @@
> 				goto fail;
> 			}
> 
>-			if (gg_fix32(n->status) == GG_STATUS_BUSY_DESCR || gg_fix32(n->status == GG_STATUS_NOT_AVAIL_DESCR) || gg_fix32(n->status) == GG_STATUS_AVAIL_DESCR) {
>+			if (gg_fix32(n->status) == GG_STATUS_BUSY_DESCR || gg_fix32(n->status) == GG_STATUS_NOT_AVAIL_DESCR || gg_fix32(n->status) == GG_STATUS_AVAIL_DESCR) {
> 				e->type = GG_EVENT_NOTIFY_DESCR;
> 				
> 				if (!(e->event.notify_descr.notify = (void*) malloc(sizeof(*n) * 2))) {
>@@ -493,6 +500,7 @@
> 				memcpy(e->event.notify_descr.notify, p, sizeof(*n));
> 				e->event.notify_descr.notify[0].uin = gg_fix32(e->event.notify_descr.notify[0].uin);
> 				e->event.notify_descr.notify[0].status = gg_fix32(e->event.notify_descr.notify[0].status);
>+				e->event.notify_descr.notify[0].remote_ip = e->event.notify_descr.notify[0].remote_ip;
> 				e->event.notify_descr.notify[0].remote_port = gg_fix16(e->event.notify_descr.notify[0].remote_port);
> 
> 				count = h->length - sizeof(*n);
>@@ -519,7 +527,8 @@
> 				for (i = 0; i < count; i++) {
> 					e->event.notify[i].uin = gg_fix32(e->event.notify[i].uin);
> 					e->event.notify[i].status = gg_fix32(e->event.notify[i].status);
>-					e->event.notify[i].remote_port = gg_fix16(e->event.notify[i].remote_port);		
>+					e->event.notify[i].remote_ip = e->event.notify[i].remote_ip;
>+					e->event.notify[i].remote_port = gg_fix16(e->event.notify[i].remote_port);
> 				}
> 			}
> 
>@@ -653,8 +669,11 @@
> 
> 				e->event.status60.descr = buf;
> 
>-				if (len > 4 && p[h->length - 5] == 0)
>-					e->event.status60.time = *((int*) (p + h->length - 4));
>+				if (len > 4 && p[h->length - 5] == 0) {
>+					uint32_t t;
>+					memcpy(&t, p + h->length - 4, sizeof(uint32_t));
>+					e->event.status60.time = gg_fix32(t);
>+				}
> 			}
> 
> 			break;
>@@ -720,7 +739,7 @@
> 
> 			if (h->length > 1) {
> 				char *tmp;
>-				int len = (sess->userlist_reply) ? strlen(sess->userlist_reply) : 0;
>+				unsigned int len = (sess->userlist_reply) ? strlen(sess->userlist_reply) : 0;
> 				
> 				gg_debug(GG_DEBUG_MISC, "userlist_reply=%p, len=%d\n", sess->userlist_reply, len);
> 				
>diff -ur ekg-1.6rc1/lib/http.c ekg-1.6rc3/lib/http.c
>--- ekg-1.6rc1/lib/http.c	2005-03-20 01:43:44.000000000 +0100
>+++ ekg-1.6rc3/lib/http.c	2005-04-14 20:55:05.000000000 +0200
>@@ -243,7 +243,7 @@
> 	}
> 
> 	if (h->state == GG_STATE_SENDING_QUERY) {
>-		unsigned int res;
>+		int res;
> 
> 		if ((res = write(h->fd, h->query, strlen(h->query))) < 1) {
> 			gg_debug(GG_DEBUG_MISC, "=> http, write() failed (len=%d, res=%d, errno=%d)\n", strlen(h->query), res, errno);
>@@ -272,7 +272,7 @@
> 
> 	if (h->state == GG_STATE_READING_HEADER) {
> 		char buf[1024], *tmp;
>-		unsigned int res;
>+		int res;
> 
> 		if ((res = read(h->fd, buf, sizeof(buf))) == -1) {
> 			gg_debug(GG_DEBUG_MISC, "=> http, reading header failed (errno=%d)\n", errno);
>@@ -380,7 +380,7 @@
> 
> 	if (h->state == GG_STATE_READING_DATA) {
> 		char buf[1024];
>-		unsigned int res;
>+		int res;
> 
> 		if ((res = read(h->fd, buf, sizeof(buf))) == -1) {
> 			gg_debug(GG_DEBUG_MISC, "=> http, reading body failed (errno=%d)\n", errno);
>diff -ur ekg-1.6rc1/lib/libgadu.c ekg-1.6rc3/lib/libgadu.c
>--- ekg-1.6rc1/lib/libgadu.c	2005-03-20 01:43:44.000000000 +0100
>+++ ekg-1.6rc3/lib/libgadu.c	2005-07-16 13:56:59.000000000 +0200
>@@ -455,13 +455,16 @@
>  *
>  *  - sess - opis sesji
>  *
>- * w przypadku b³êdu NULL, kod b³êdu w errno.
>+ * w przypadku b³êdu NULL, kod b³êdu w errno. nale¿y zwróciæ uwagê, ¿e gdy
>+ * po³±czenie jest nieblokuj±ce, a kod b³êdu wynosi EAGAIN, nie uda³o siê
>+ * odczytaæ ca³ego pakietu i nie nale¿y tego traktowaæ jako b³±d.
>  */
> void *gg_recv_packet(struct gg_session *sess)
> {
> 	struct gg_header h;
> 	char *buf = NULL;
>-	int ret = 0, offset, size = 0;
>+	int ret = 0;
>+	unsigned int offset, size = 0;
> 
> 	gg_debug(GG_DEBUG_FUNCTION, "** gg_recv_packet(%p);\n", sess);
> 	
>@@ -485,7 +488,7 @@
> 			gg_debug(GG_DEBUG_MISC, "// gg_recv_packet() header recv(%d,%p,%d) = %d\n", sess->fd, &h + sess->header_done, sizeof(h) - sess->header_done, ret);
> 
> 			if (!ret) {
>-				errno = 0;
>+				errno = ECONNRESET;
> 				gg_debug(GG_DEBUG_MISC, "// gg_recv_packet() header recv() failed: connection broken\n");
> 				return NULL;
> 			}
>@@ -524,7 +527,7 @@
> 		memcpy(&h, sess->recv_buf, sizeof(h));
> 	
> 	/* jakie¶ sensowne limity na rozmiar pakietu */
>-	if (h.length < 0 || h.length > 65535) {
>+	if (h.length > 65535) {
> 		gg_debug(GG_DEBUG_MISC, "// gg_recv_packet() invalid packet length (%d)\n", h.length);
> 		errno = ERANGE;
> 		return NULL;
>@@ -550,11 +553,20 @@
> 	while (size > 0) {
> 		ret = gg_read(sess, buf + sizeof(h) + offset, size);
> 		gg_debug(GG_DEBUG_MISC, "// gg_recv_packet() body recv(%d,%p,%d) = %d\n", sess->fd, buf + sizeof(h) + offset, size, ret);
>+		if (!ret) {
>+			gg_debug(GG_DEBUG_MISC, "// gg_recv_packet() body recv() failed: connection broken\n");
>+			errno = ECONNRESET;
>+			return NULL;
>+		}
> 		if (ret > -1 && ret <= size) {
> 			offset += ret;
> 			size -= ret;
> 		} else if (ret == -1) {	
>+			int errno2 = errno;
>+
> 			gg_debug(GG_DEBUG_MISC, "// gg_recv_packet() body recv() failed (errno=%d, %s)\n", errno, strerror(errno));
>+			errno = errno2;
>+
> 			if (errno == EAGAIN) {
> 				gg_debug(GG_DEBUG_MISC, "// gg_recv_packet() %d bytes received, %d left\n", offset, size);
> 				sess->recv_buf = buf;
>@@ -605,9 +617,9 @@
> {
> 	struct gg_header *h;
> 	char *tmp;
>-	int tmp_length;
>+	unsigned int tmp_length;
> 	void *payload;
>-	int payload_length;
>+	unsigned int payload_length;
> 	va_list ap;
> 	int res;
> 
>@@ -627,11 +639,8 @@
> 	while (payload) {
> 		char *tmp2;
> 
>-		payload_length = va_arg(ap, int);
>+		payload_length = va_arg(ap, unsigned int);
> 
>-		if (payload_length < 0)
>-			gg_debug(GG_DEBUG_MISC, "// gg_send_packet() invalid payload length (%d)\n", payload_length);
>-	
> 		if (!(tmp2 = realloc(tmp, tmp_length + payload_length))) {
> 			gg_debug(GG_DEBUG_MISC, "// gg_send_packet() not enough memory for payload\n");
> 			free(tmp);
>@@ -1435,7 +1446,7 @@
> 		return -1;
> 	}
> 
>-	if (!message || recipients_count <= 0 || !recipients) {
>+	if (!message || recipients_count <= 0 || recipients_count > 0xffff || !recipients) {
> 		errno = EINVAL;
> 		return -1;
> 	}

Actions: View | Diff

Attachments on bug 97408: 42706 | 42823 | 44436