Attachment 158077 Details for Bug 246034 – Fix for three denial of service vulnerabilities in ekg

Fix for three denial of service vulnerabilities in ekg

ekg-CVE-2007-166x.patch (text/x-patch), 2.30 KB, created by Lubomir Kundrak on 2007-06-27 23:18:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Kundrak

Created: 2007-06-27 23:18:07 UTC

Size: 2.30 KB

patch

obsolete

>Patch for CVE-2007-166{3,4,5} ekg denial of service vulnerabilities
>sucked in from Debian package.
>
>--- ekg-1.7rc2.orig/src/events.c	2007-06-28 00:15:51.000000000 +0200
>+++ ekg-1.7rc2/src/events.c	2007-06-28 01:12:45.000000000 +0200
>@@ -522,8 +522,10 @@ void handle_msg(struct gg_event *e)
> 		}
> 
> 		/* ignorujemy wiadomo¶ci bez tre¶ci zawieraj±ce jedynie obrazek(ki) */
>-		if (config_ignore_empty_msg && imageno && strlen(e->event.msg.message) == 0)
>+		if (config_ignore_empty_msg && imageno && strlen(e->event.msg.message) == 0) {
>+			list_destroy(images, 1);
> 			return;
>+		}
> 	}
> 
> #ifdef HAVE_OPENSSL
>@@ -567,6 +569,7 @@ void handle_msg(struct gg_event *e)
> 
> 	switch (python_handle_result) {
> 		case 0:
>+			list_destroy(images, 1);
> 			return;
> 		case 2:
> 			hide = 1;
>@@ -586,6 +589,7 @@ void handle_msg(struct gg_event *e)
> 			config_last_sysmsg_changed = 1;
> 		}
> 
>+		list_destroy(images, 1);
> 		return;
> 	}
> 	
>@@ -594,14 +598,17 @@ void handle_msg(struct gg_event *e)
> 			e->event.msg.sender, e->event.msg.recipients,
> 			e->event.msg.recipients_count, 0);
> 
>-		if (c && c->ignore)
>+		if (c && c->ignore) {
>+			list_destroy(images, 1);
> 			return;
>+		}
> 	}
> 
> 	if ((!u && config_ignore_unknown_sender) || ignored_check(e->event.msg.sender) & IGNORE_MSG) {
> 		if (config_log_ignored)
> 			put_log(e->event.msg.sender, "%sign,%ld,%s,%s,%s,%s\n", (chat) ? "chatrecv" : "msgrecv", e->event.msg.sender, ((u && u->display) ? u->display : ""), log_timestamp(time(NULL)), log_timestamp(e->event.msg.time), e->event.msg.message);
> 
>+		list_destroy(images, 1);
> 		return;
> 	}
> 
>@@ -1513,6 +1520,11 @@ int token_gif_load (char *fname, struct 
> 		goto err2;
> 	}
> 
>+	if (file->SWidth <= 0 || file->SWidth > 1024 || file->SHeight <= 0 || file->SHeight > 1024) {
>+		snprintf(errbuf, sizeof(errbuf), "Invalid image size: %d,%d", file->SWidth, file->SHeight);
>+		goto err3;
>+	}
>+
> 	if (DGifSlurp(file) != GIF_OK) {
> 		snprintf (errbuf, sizeof(errbuf), "DGifSlurp(): %d", GifLastError());
> 		goto err3;
>@@ -1735,7 +1747,7 @@ char *token_gif_to_txt (struct token_t *
> 	int cur_char = 0;	/* Kolejny znaczek z chars[]. */
> 
> 	memset (mappings, 0, sizeof(mappings));
>-	buf = bptr = (char *) xmalloc(token->sx * (token->sy + 1));
>+	buf = bptr = (char *) xmalloc(token->sx * (token->sy + 1) + 1);
> 
> #ifdef TOKEN_GIF_PAL
> 	for (i = 0; i < token->sx * token->sy; i++) {

Actions: View

Attachments on bug 246034: 158077