comparison libpurple/proxy.c @ 32796:5ae7e1f36b43

Fix a possible XMPP remote crash A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests. The fix is to correctly cancel and free a SOCKS5 connection attempt so that it does not trigger an attempt to access invalid memory later. This was reported to us by Jos«± Valent«żn Guti«±rrez and this patch is written by Paul Aurich.

32795:a359399cc0ce

	 * This contains alternating length/char* values.  The char*
	 * values need to be freed when removed from the linked list.
	 */
	GSList *hosts;

	/*
	 * All of the following variables are used when establishing a
	 * connection through a proxy.
	 */
	guchar *write_buffer;

 *        connection was successful then pass in null.
 */
static void
purple_proxy_connect_data_disconnect(PurpleProxyConnectData *connect_data, const gchar *error_message)
{
	if (connect_data->inpa > 0)
	{
		purple_input_remove(connect_data->inpa);
		connect_data->inpa = 0;
	}

static void socks5_connected_to_proxy(gpointer data, gint source,
		const gchar *error_message) {
	/* This is the PurpleProxyConnectData for the overall SOCKS5 connection */
	PurpleProxyConnectData *connect_data = data;

	/* Check that the overall SOCKS5 connection wasn't cancelled while we were
	 * connecting to it (we don't have a way of associating the process of
	 * connecting to the SOCKS5 server to the overall PurpleProxyConnectData)
	 */
	if (!PURPLE_PROXY_CONNECT_DATA_IS_VALID(connect_data))
		return;

	if (error_message != NULL) {
		purple_debug_error("proxy", "Unable to connect to SOCKS5 host.\n");
		connect_data->connect_cb(connect_data->data, source, error_message);
		return;

		purple_debug_error("proxy", "Unable to initiate connection to account proxy.\n");
		purple_proxy_connect_data_destroy(connect_data);
		return NULL;
	}

	/* The API doesn't really provide us with a way to cancel the specific
	 * proxy connection attempt (account_proxy_conn_data) when the overall
	 * SOCKS5 connection (connect_data) attempt is cancelled :(
	 */

	handles = g_slist_prepend(handles, connect_data);

	return connect_data;
}

void
purple_proxy_connect_cancel(PurpleProxyConnectData *connect_data)
{
	purple_proxy_connect_data_disconnect(connect_data, NULL);
	purple_proxy_connect_data_destroy(connect_data);
}

void

32796:5ae7e1f36b43

	 * This contains alternating length/char* values.  The char*
	 * values need to be freed when removed from the linked list.
	 */
	GSList *hosts;

	PurpleProxyConnectData *child;

	/*
	 * All of the following variables are used when establishing a
	 * connection through a proxy.
	 */
	guchar *write_buffer;

 *        connection was successful then pass in null.
 */
static void
purple_proxy_connect_data_disconnect(PurpleProxyConnectData *connect_data, const gchar *error_message)
{
	if (connect_data->child != NULL)
	{
		purple_proxy_connect_cancel(connect_data->child);
		connect_data->child = NULL;
	}

	if (connect_data->inpa > 0)
	{
		purple_input_remove(connect_data->inpa);
		connect_data->inpa = 0;
	}

static void socks5_connected_to_proxy(gpointer data, gint source,
		const gchar *error_message) {
	/* This is the PurpleProxyConnectData for the overall SOCKS5 connection */
	PurpleProxyConnectData *connect_data = data;

	purple_debug_error("proxy", "Connect Data is %p\n", connect_data);

	/* Check that the overall SOCKS5 connection wasn't cancelled while we were
	 * connecting to it (we don't have a way of associating the process of
	 * connecting to the SOCKS5 server to the overall PurpleProxyConnectData)
	 */
	if (!PURPLE_PROXY_CONNECT_DATA_IS_VALID(connect_data)) {
		purple_debug_error("proxy", "Data had gone out of scope :(\n");
		return;
	}

	/* Break the link between the two PurpleProxyConnectDatas  */
	connect_data->child = NULL;

	if (error_message != NULL) {
		purple_debug_error("proxy", "Unable to connect to SOCKS5 host.\n");
		connect_data->connect_cb(connect_data->data, source, error_message);
		return;

		purple_debug_error("proxy", "Unable to initiate connection to account proxy.\n");
		purple_proxy_connect_data_destroy(connect_data);
		return NULL;
	}

	connect_data->child = account_proxy_conn_data;

	handles = g_slist_prepend(handles, connect_data);

	return connect_data;
}

void
purple_proxy_connect_cancel(PurpleProxyConnectData *connect_data)
{
	g_return_if_fail(connect_data != NULL);

	purple_proxy_connect_data_disconnect(connect_data, NULL);
	purple_proxy_connect_data_destroy(connect_data);
}

void