comparison libpurple/protocols/msn/msn.c @ 30174:b0bc67f42027

Fix a possible use-after-free. If the user initiated a file transfer while a display pic transfer was in progress, and that transfer finished before the user selected a file, then the MsnSlpLink to that user could be used after it's freed. Also, if there were a conversation open to that user, then the slplink would not be freed, so the FT must be started from the buddy list. Fixes #6453.

30173:4ebecacf2fbb

static void
t_msn_xfer_init(PurpleXfer *xfer)
{
	MsnSlpLink *slplink = xfer->data;
	msn_slplink_request_ft(slplink, xfer);
}

static PurpleXfer*
msn_new_xfer(PurpleConnection *gc, const char *who)
{

	xfer = purple_xfer_new(gc->account, PURPLE_XFER_SEND, who);

	g_return_val_if_fail(xfer != NULL, NULL);

	xfer->data = msn_session_get_slplink(session, who);

	purple_xfer_set_init_fnc(xfer, t_msn_xfer_init);

	return xfer;
}

static void

30174:b0bc67f42027

static void
t_msn_xfer_init(PurpleXfer *xfer)
{
	MsnSlpLink *slplink = xfer->data;
	msn_slplink_request_ft(slplink, xfer);
	msn_slplink_unref(slplink);
}

static void
t_msn_xfer_cancel_send(PurpleXfer *xfer)
{
	MsnSlpLink *slplink = xfer->data;
	msn_slplink_unref(slplink);
}

static PurpleXfer*
msn_new_xfer(PurpleConnection *gc, const char *who)
{

	xfer = purple_xfer_new(gc->account, PURPLE_XFER_SEND, who);

	g_return_val_if_fail(xfer != NULL, NULL);

	xfer->data = msn_slplink_ref(msn_session_get_slplink(session, who));

	purple_xfer_set_init_fnc(xfer, t_msn_xfer_init);
	purple_xfer_set_cancel_send_fnc(xfer, t_msn_xfer_cancel_send);

	return xfer;
}

static void