Attachment 855922 Details for Bug 1056913 – Local copy of patch 1

[patch] Local copy of patch 1

CVE-2013-6482-1.diff (text/plain), 1.66 KB, created by Huzaifa S. Sidhpurwala on 2014-01-27 06:12:21 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Huzaifa S. Sidhpurwala

Created: 2014-01-27 06:12:21 UTC

Size: 1.66 KB

patch

obsolete

>changeset:   33826:23cbfff68a0c
>branch:      release-2.x.y
>user:        Daniel Atallah <datallah@pidgin.im>
>date:        Sat Mar 16 14:17:45 2013 -0400
>summary:     msn: Fix NUL-pointer deref issue parsing Message Headers
>
>diff -r 932b985540e9 -r 23cbfff68a0c libpurple/protocols/msn/msg.c
>--- a/libpurple/protocols/msn/msg.c	Sat Mar 16 14:05:51 2013 -0400
>+++ b/libpurple/protocols/msn/msg.c	Sat Mar 16 14:17:45 2013 -0400
>@@ -178,6 +178,8 @@ msn_message_parse_payload(MsnMessage *ms
> 		g_free(tmp_base);
> 		g_return_if_reached();
> 	}
>+
>+	/* NUL-terminate the end of the headers - it'll get skipped over below */
> 	*end = '\0';
> 
> 	/* Split the headers and parse each one */
>@@ -195,10 +197,12 @@ msn_message_parse_payload(MsnMessage *ms
> 
> 			/* The only one I care about is 'boundary' (which is folded from
> 			   the key 'Content-Type'), so only process that. */
>-			if (!strcmp(key, "boundary")) {
>+			if (!strcmp(key, "boundary") && value) {
> 				char *end = strchr(value, '\"');
>-				*end = '\0';
>-				msn_message_set_header(msg, key, value);
>+				if (end) {
>+					*end = '\0';
>+					msn_message_set_header(msg, key, value);
>+				}
> 			}
> 
> 			g_strfreev(tokens);
>@@ -210,18 +214,15 @@ msn_message_parse_payload(MsnMessage *ms
> 		key = tokens[0];
> 		value = tokens[1];
> 
>-		/*if not MIME content ,then return*/
> 		if (!strcmp(key, "MIME-Version"))
> 		{
>-			g_strfreev(tokens);
>-			continue;
>+			/* Ignore MIME-Version header */
> 		}
>-
>-		if (!strcmp(key, "Content-Type"))
>+		else if (!strcmp(key, "Content-Type"))
> 		{
> 			char *charset, *c;
> 
>-			if ((c = strchr(value, ';')) != NULL)
>+			if (value && (c = strchr(value, ';')) != NULL)
> 			{
> 				if ((charset = strchr(c, '=')) != NULL)
> 				{
>

Actions: View | Diff

Attachments on bug 1056913: 855922 | 855923 | 855924