Attachment 696213 Details for Bug 910039 – Local copy of (by Pidgin upstream) proposed patch to fix the CVE-2013-0271 issue

[patch] Local copy of (by Pidgin upstream) proposed patch to fix the CVE-2013-0271 issue

CVE-2013-0271.diff (text/plain), 2.09 KB, created by Jan Lieskovsky on 2013-02-11 16:56:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Lieskovsky

Created: 2013-02-11 16:56:22 UTC

Size: 2.09 KB

patch

obsolete

>diff -r bf6e40d37a72 libpurple/protocols/mxit/formcmds.c
>--- a/libpurple/protocols/mxit/formcmds.c	Mon Jan 21 19:56:34 2013 -0800
>+++ b/libpurple/protocols/mxit/formcmds.c	Mon Jan 21 23:51:22 2013 -0800
>@@ -405,19 +405,29 @@
> 		guchar*		rawimg;
> 		gsize		rawimglen;
> 		char*		dir;
>+		char*		escfrom;
>+		char*		escname;
>+		char*		escvalidator;
> 		char*		filename;
> 
> 		/* base64 decode the image data */
> 		rawimg = purple_base64_decode(tmp, &rawimglen);
> 
> 		/* save it to a file */
>-		dir = g_strdup_printf("%s/mxit/imagestrips", purple_user_dir());
>+		dir = g_build_filename(purple_user_dir(), "mxit", "imagestrips", NULL);
> 		purple_build_dir(dir, S_IRUSR | S_IWUSR | S_IXUSR);		/* ensure directory exists */
> 
>-		filename = g_strdup_printf("%s/%s-%s-%s.png", dir, from, name, validator);
>+		escfrom = g_strdup(purple_escape_filename(from));
>+		escname = g_strdup(purple_escape_filename(name));
>+		escvalidator = g_strdup(purple_escape_filename(validator));
>+		filename = g_strdup_printf("%s" G_DIR_SEPARATOR_S "%s-%s-%s.png", dir, escfrom, escname, escvalidator);
>+
> 		purple_util_write_data_to_file_absolute(filename, (char*) rawimg, rawimglen);
> 
> 		g_free(dir);
>+		g_free(escfrom);
>+		g_free(escname);
>+		g_free(escvalidator);
> 		g_free(filename);
> 	}
> 
>diff -r bf6e40d37a72 libpurple/protocols/mxit/splashscreen.c
>--- a/libpurple/protocols/mxit/splashscreen.c	Mon Jan 21 19:56:34 2013 -0800
>+++ b/libpurple/protocols/mxit/splashscreen.c	Mon Jan 21 23:51:22 2013 -0800
>@@ -121,10 +121,10 @@
> 	splash_remove(session);
> 
> 	/* Save the new splash image */
>-	dir = g_strdup_printf("%s/mxit",  purple_user_dir());
>+	dir = g_strdup_printf("%s" G_DIR_SEPARATOR_S "mxit",  purple_user_dir());
> 	purple_build_dir(dir, S_IRUSR | S_IWUSR | S_IXUSR);		/* ensure directory exists */
> 
>-	filename = g_strdup_printf("%s/%s.png", dir, splashId);
>+	filename = g_strdup_printf("%s" G_DIR_SEPARATOR_S "%s.png", dir, purple_escape_filename(splashId));
> 	if (purple_util_write_data_to_file_absolute(filename, data, datalen)) {
> 		/* Store new splash-screen ID to settings */
> 		purple_account_set_string(session->acc, MXIT_CONFIG_SPLASHID, splashId);

Actions: View | Diff

Attachments on bug 910039: 696213