view libpurple/eventloop.c @ 24420:caf82c1cebf2

I've seen this crash a few times where cmd->param_count is 4 and we try to access params[4] which is invalid. The backtrace is: #0 0x0000003c4c4341ca in ____strtoll_l_internal () from /lib64/libc.so.6 #1 0x0000003c4c431ab2 in atoi () from /lib64/libc.so.6 #2 0x00000000005f0abe in ubm_cmd (cmdproc=0xc86eb30, cmd=0xc832e00) at notification.c:494 #3 0x00000000005efef1 in msn_cmdproc_process_cmd (cmdproc=0xc86eb30, cmd=0xc832e00) at cmdproc.c:321 #4 0x00000000005eff97 in msn_cmdproc_process_cmd_text (cmdproc=0xc86eb30, command=0xcadb390 "UBM [e-mail] 32 1 170") at cmdproc.c:343 #5 0x00000000005f9d8f in read_cb (data=0xc86ea90, source=9, cond=PURPLE_INPUT_READ) at servconn.c:439 #6 0x00000000004db70c in pidgin_io_invoke (source=0xc8369f0, condition=G_IO_IN, data=0xc836570) at gtkeventloop.cc:79 Here are some other values I've seen for command in frame 4: UBM [e-mail] 32 1 170 UBM [e-mail] 32 2 91 UBM [e-mail] 32 2 93

/**
 * @file eventloop.c Purple Event Loop API
 * @ingroup core
 */

/* purple
 *
 * Purple is the legal property of its developers, whose names are too numerous
 * to list here.  Please refer to the COPYRIGHT file distributed with this
 * source distribution.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02111-1301  USA
 */
#include "eventloop.h"
#include "internal.h"

static PurpleEventLoopUiOps *eventloop_ui_ops = NULL;

guint
purple_timeout_add(guint interval, GSourceFunc function, gpointer data)
{
	PurpleEventLoopUiOps *ops = purple_eventloop_get_ui_ops();

	return ops->timeout_add(interval, function, data);
}

guint
purple_timeout_add_seconds(guint interval, GSourceFunc function, gpointer data)
{
	PurpleEventLoopUiOps *ops = purple_eventloop_get_ui_ops();

	if (ops->timeout_add_seconds)
		return ops->timeout_add_seconds(interval, function, data);
	else
		return ops->timeout_add(1000 * interval, function, data);
}

gboolean
purple_timeout_remove(guint tag)
{
	PurpleEventLoopUiOps *ops = purple_eventloop_get_ui_ops();

	return ops->timeout_remove(tag);
}

guint
purple_input_add(int source, PurpleInputCondition condition, PurpleInputFunction func, gpointer user_data)
{
	PurpleEventLoopUiOps *ops = purple_eventloop_get_ui_ops();

	return ops->input_add(source, condition, func, user_data);
}

gboolean
purple_input_remove(guint tag)
{
	PurpleEventLoopUiOps *ops = purple_eventloop_get_ui_ops();

	return ops->input_remove(tag);
}

int
purple_input_get_error(int fd, int *error)
{
	PurpleEventLoopUiOps *ops = purple_eventloop_get_ui_ops();

	if (ops->input_get_error)
	{
		int ret = ops->input_get_error(fd, error);
		errno = *error;
		return ret;
	}
	else
	{
		socklen_t len;
		len = sizeof(*error);

		return getsockopt(fd, SOL_SOCKET, SO_ERROR, error, &len);
	}
}

void
purple_eventloop_set_ui_ops(PurpleEventLoopUiOps *ops)
{
	eventloop_ui_ops = ops;
}

PurpleEventLoopUiOps *
purple_eventloop_get_ui_ops(void)
{
	g_return_val_if_fail(eventloop_ui_ops != NULL, NULL);

	return eventloop_ui_ops;
}