Blame SOURCES/pidgin-2.10.7-CVE-2013-6489.patch
|
 |
4133dc |
diff -up pidgin-2.10.7/libpurple/protocols/mxit/markup.c.CVE-2013-6489 pidgin-2.10.7/libpurple/protocols/mxit/markup.c
|
|
|
4133dc |
--- pidgin-2.10.7/libpurple/protocols/mxit/markup.c.CVE-2013-6489 2013-02-11 04:16:52.000000000 -0500
|
|
|
4133dc |
+++ pidgin-2.10.7/libpurple/protocols/mxit/markup.c 2014-01-29 20:55:34.239345911 -0500
|
|
|
4133dc |
@@ -204,7 +204,8 @@ static unsigned int asn_getlength( const
|
|
|
4133dc |
*/
|
|
|
4133dc |
static int asn_getUtf8( const char* data, char type, char** utf8 )
|
|
|
4133dc |
{
|
|
|
4133dc |
- int len;
|
|
|
4133dc |
+ unsigned int len;
|
|
|
4133dc |
+ gchar *out_str;
|
|
|
4133dc |
|
|
|
4133dc |
/* validate the field type [1 byte] */
|
|
|
4133dc |
if ( data[0] != type ) {
|
|
|
4133dc |
@@ -213,10 +214,17 @@ static int asn_getUtf8( const char* data
|
|
|
4133dc |
return -1;
|
|
|
4133dc |
}
|
|
|
4133dc |
|
|
|
4133dc |
- len = data[1]; /* length field [1 bytes] */
|
|
|
4133dc |
- *utf8 = g_malloc( len + 1 );
|
|
|
4133dc |
- memcpy( *utf8, &data[2], len ); /* data field */
|
|
|
4133dc |
- (*utf8)[len] = '\0';
|
|
|
4133dc |
+ len = (uint8_t)data[1]; /* length field [1 byte] */
|
|
|
4133dc |
+ out_str = g_malloc(len + 1);
|
|
|
4133dc |
+ if (out_str == NULL) {
|
|
|
4133dc |
+ purple_debug_fatal(MXIT_PLUGIN_ID, "asn_getUtf8: out of memory");
|
|
|
4133dc |
+ return -1;
|
|
|
4133dc |
+ }
|
|
|
4133dc |
+
|
|
|
4133dc |
+ memcpy(out_str, &data[2], len); /* data field */
|
|
|
4133dc |
+ out_str[len] = '\0';
|
|
|
4133dc |
+
|
|
|
4133dc |
+ *utf8 = out_str;
|
|
|
4133dc |
|
|
|
4133dc |
return ( len + 2 );
|
|
|
4133dc |
}
|