Bugzilla – Attachment 45236 Details for
Bug 102961
VUL-0: CVE-2005-21: gaim problems
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
IDP Log In
|
Forgot Password
[patch]
the other attachment
gaim_oldstatus_aim_away_message_substitution_buffer_overflow_fix.diff (text/plain), 1.83 KB, created by
Sebastian Krahmer
on 2005-08-09 09:13:36 UTC
(
hide
)
Description:
the other attachment
Filename:
MIME Type:
Creator:
Sebastian Krahmer
Created:
2005-08-09 09:13:36 UTC
Size:
1.83 KB
patch
obsolete
>Index: src/util.c >=================================================================== >RCS file: /cvsroot/gaim/gaim/src/util.c,v >retrieving revision 1.325.2.25 >diff -u -d -p -u -d -p -r1.325.2.25 util.c >--- src/util.c 31 Jul 2005 15:21:01 -0000 1.325.2.25 >+++ src/util.c 8 Aug 2005 02:48:15 -0000 >@@ -2141,8 +2141,7 @@ gchar * > gaim_str_sub_away_formatters(const char *str, const char *name) > { > char *c; >- gchar *cpy; >- int cnt = 0; >+ GString *cpy; > time_t t; > struct tm *tme; > char tmp[20]; >@@ -2150,12 +2149,12 @@ gaim_str_sub_away_formatters(const char > g_return_val_if_fail(str != NULL, NULL); > g_return_val_if_fail(name != NULL, NULL); > >- cpy = g_malloc(BUF_LONG); >+ /* Create an empty GString that is hopefully big enough for most messages */ >+ cpy = g_string_sized_new(1024); > > t = time(NULL); > tme = localtime(&t); > >- cpy[0] = '\0'; > c = (char *)str; > while (*c) { > switch (*c) { >@@ -2164,39 +2163,35 @@ gaim_str_sub_away_formatters(const char > switch (*(c + 1)) { > case 'n': > /* append name */ >- strcpy(cpy + cnt, name); >- cnt += strlen(name); >+ g_string_append(cpy, name); > c++; > break; > case 'd': > /* append date */ > strftime(tmp, 20, "%m/%d/%Y", tme); >- strcpy(cpy + cnt, tmp); >- cnt += strlen(tmp); >+ g_string_append(cpy, tmp); > c++; > break; > case 't': > /* append time */ > strftime(tmp, 20, "%I:%M:%S %p", tme); >- strcpy(cpy + cnt, tmp); >- cnt += strlen(tmp); >+ g_string_append(cpy, tmp); > c++; > break; > default: >- cpy[cnt++] = *c; >+ g_string_append_c(cpy, *c); > } > } else { >- cpy[cnt++] = *c; >+ g_string_append_c(cpy, *c); > } > break; > default: >- cpy[cnt++] = *c; >+ g_string_append_c(cpy, *c); > } > c++; > } >- cpy[cnt] = '\0'; > >- return cpy; >+ return g_string_free(cpy, FALSE); > } > > gchar *
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
Actions:
View
|
Diff
Attachments on
bug 102961
:
45235
| 45236 |
45469
|
45470