Mercurial > pidgin
annotate README.MTN @ 30273:6829b27ee4c8
This patch attempts to fix four bugs in the oscar protocol plugin that
were introduced with the X-Status code in Pidgin 2.7.0.
Problem #1 (the remotely-triggerable crash):
The crash happens when a buddy sets an xstatus message containing <desc>
but no closing </desc>, or <title> but no closing </title>. The fix
is to check the result of strstr(closing_tag_name) and do nothing if it
is NULL. This is CVE-2010-2528.
Problem #2:
Fixes potential incorrect parsing of the xstatus string that could result
in an incorrect message being displayed to the libpurple user. Happens if
an xstatus message contains </desc> before <desc>, or </title> before
<title>. The fix is to start looking for the closing tag at the end
of the beginning tag rather than at the beginning of the xstatus xml.
Probably not a security problem, but definitely a bug.
Problem #3:
Fixes potential incorrect parsing of the xstatus string that could result
in the title not being shown to the libpurple user. Happens if the close
title tag appears after the desc tag in the xstatus xml, because we add a
null character at the beginning of the close title tag, so strstr() for
the desc tag would stop searching there. Probably not a security problem,
but definitely a bug.
Problem #4:
Fixes potential incorrect display of the xstatus string that could result
in an incorrect message being displayed to the libpurple user. Happens
because we reusing the 'xml' string when preparing the string for the user,
but we copy values from xml to xml. If those values overlap with themselves
or with each other then an incorrect value could be displayed. Probably not
a security problem, but definitely a bug.
author | Mark Doliner <mark@kingant.net> |
---|---|
date | Wed, 21 Jul 2010 02:49:23 +0000 |
parents | e0bcb8cfda74 |
children |
rev | line source |
---|---|
16176
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
1 If you plan to use Pidgin, Finch and libpurple from our Monotone repository, |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
2 PLEASE read this message in its entirety! |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
3 |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
4 Pidgin, Finch, and libpurple are a fast-moving project with a somewhat regular |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
5 release schedule. Due to the rate of development, the code in our Monotone |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
6 repository undergoes frequent bursts of massive changes, often leaving behind |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
7 brokenness and partial functionality while the responsible developers rewrite |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
8 some portion of code or seek to add new features. |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
9 |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
10 What this all boils down to is that the code in our Monotone repository _WILL_ |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
11 sometimes be broken. Because of this, we ask that users who are not interested |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
12 in personally tracking down bugs and fixing them (without a lot of |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
13 assistance from the developers!) use only released versions. Since releases |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
14 will be made often, this should not prevent anyone from using the newest, |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
15 shiniest features -- but it will prevent users from having to deal with ugly |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
16 development bugs that we already know about but haven't gotten around to fixing. |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
17 |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
18 If you are interested in hacking on Pidgin, Finch, and/or libpurple, please |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
19 check out the information available at: http://developer.pidgin.im |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
20 |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
21 By far the best documentation, however, is the documented code. If you have |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
22 doxygen, you can run "make docs" in the toplevel directory to generate pretty |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
23 documentation. Otherwise (or even if you do!), the header files for each |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
24 subsystem contain documentation for the functions they contain. For instance, |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
25 conversation.h contains documentation for the entire purple_conversation_* |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
26 API, and account.h contains documentation for the purple_account_* API. |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
27 |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
28 If you have questions, please feel free to contact the Pidgin, Finch, and |
23180
e0bcb8cfda74
Use "email" and "Email" consistently. This is potentially controversial,
Richard Laager <rlaager@wiktel.com>
parents:
16176
diff
changeset
|
29 libpurple developers by email at devel@pidgin.im or on IRC at irc.freenode.net |
16176
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
30 in #pidgin. Please do as much homework as you can before contacting us; the |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
31 more you know about your question, the faster and more effectively we can help! |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
32 |
83ec0b408926
Beat some older documentation into submission.
Richard Laager <rlaager@wiktel.com>
parents:
diff
changeset
|
33 Patches should be posted as Trac tickets at: http://developer.pidgin.im |