Mercurial > pidgin.yaz
changeset 30703:5884388dfd06
Fix a crash bug in oscar related to trying to allocate too much memory.
This was reported to our security mailing list by Jan Kaluza The Great.
I honestly couldn't figure out how to repro this crash, so I've been
considering it as not a remote-crash security problem, so I chose to
skip the CVE process for this.
| author | Mark Doliner <mark@kingant.net> |
|---|---|
| date | Wed, 21 Jul 2010 02:57:51 +0000 |
| parents | 6829b27ee4c8 |
| children | afa721f12561 |
| files | libpurple/protocols/oscar/oscar.c |
| diffstat | 1 files changed, 11 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/libpurple/protocols/oscar/oscar.c Wed Jul 21 02:49:23 2010 +0000 +++ b/libpurple/protocols/oscar/oscar.c Wed Jul 21 02:57:51 2010 +0000 @@ -3028,12 +3028,23 @@ if (smstype != 0) break; taglen = byte_stream_getle32(&qbs); + if (taglen > 2000) { + /* Avoid trying to allocate large amounts of memory, in + case we get something unexpected. */ + break; + } tagstr = byte_stream_getstr(&qbs, taglen); if (tagstr == NULL) break; byte_stream_advance(&qbs, 3); byte_stream_advance(&qbs, 4); smslen = byte_stream_getle32(&qbs); + if (smslen > 2000) { + /* Avoid trying to allocate large amounts of memory, in + case we get something unexpected. */ + g_free(tagstr); + break; + } smsmsg = byte_stream_getstr(&qbs, smslen); /* Check if this is an SMS being sent from server */