comparison libpurple/protocols/qq/im.c @ 31053:943fce8ef142

Fix for CVE-2010-3711. Properly validate the return value from purple_base64_decode() (the CVE issue) and purple_base16_decode() (just a bug). Coincidentally, this should also fix #12614. committer: John Bailey <[e-mail]>

31044:0050a61df60c

{
	qq_im_format *fmt;
	const gchar *start, *end, *last;
	GData *attribs;
	gchar *tmp;
	unsigned char *rgb;

	g_return_val_if_fail(msg != NULL, NULL);

	fmt = qq_im_fmt_new();

			fmt->attr &= 0x0f;
		}

		tmp = g_datalist_get_data(&attribs, "color");
		if (tmp && strlen(tmp) > 1) {
			rgb = purple_base16_decode(tmp + 1, NULL);
			g_memmove(fmt->rgb, rgb, 3);
			g_free(rgb);
		}

		g_datalist_clear(&attribs);
		last = end + 1;

31053:943fce8ef142

{
	qq_im_format *fmt;
	const gchar *start, *end, *last;
	GData *attribs;
	gchar *tmp;

	g_return_val_if_fail(msg != NULL, NULL);

	fmt = qq_im_fmt_new();

			fmt->attr &= 0x0f;
		}

		tmp = g_datalist_get_data(&attribs, "color");
		if (tmp && strlen(tmp) > 1) {
			unsigned char *rgb;
			gsize rgb_len;
			rgb = purple_base16_decode(tmp + 1, &rgb_len);
			if (rgb != NULL && rgb_len >= 3)
				g_memmove(fmt->rgb, rgb, 3);
			g_free(rgb);
		}

		g_datalist_clear(&attribs);
		last = end + 1;