comparison libpurple/protocols/msn/slpcall.c @ 30885:555862567b38

Manually propagate the fix for CVE-2010-3711.
author masca@cpw.pidgin.im
date Sat, 30 Oct 2010 17:45:46 +0000
parents c209701a3152
children b09ec659a9f5
comparison
equal deleted inserted replaced
30884:c20f67f37d2b 30885:555862567b38
525 525
526 xfer = purple_xfer_new(account, PURPLE_XFER_RECEIVE, 526 xfer = purple_xfer_new(account, PURPLE_XFER_RECEIVE,
527 slpcall->slplink->remote_user); 527 slpcall->slplink->remote_user);
528 528
529 header = (MsnFileContext *)purple_base64_decode(context, &bin_len); 529 header = (MsnFileContext *)purple_base64_decode(context, &bin_len);
530 if (bin_len >= sizeof(MsnFileContext) - 1 && 530 if (header != NULL && bin_len >= sizeof(MsnFileContext) - 1 &&
531 (header->version == 2 || 531 (header->version == 2 ||
532 (header->version == 3 && header->length == sizeof(MsnFileContext) + 63))) { 532 (header->version == 3 && header->length == sizeof(MsnFileContext) + 63))) {
533 file_size = GUINT64_FROM_LE(header->file_size); 533 file_size = GUINT64_FROM_LE(header->file_size);
534 534
535 file_name = g_convert((const gchar *)&header->file_name, 535 file_name = g_convert((const gchar *)&header->file_name,