comparison libpurple/protocols/oscar/family_feedbag.c @ 32376:82024b6ea465

Fix remotely-triggerable crashes by validating strings in a few messages related to buddy list management. Fixes #14682 I changed the four functions that parse incoming authorization-related SNACs. The changes are: - Make sure we have a buddy name and it is valid UTF-8. If not, we drop the SNAC and log a debug message (we can't do much with an empty, invalid or incorrect buddy name). This wasn't a part of the bug report and I doubt it's actually a problem, but it seems like a good idea regardless. - If the incoming message is not valid UTF-8 then use purple_utf8_salvage() to replace invalid bytes with question marks. I believe this fixes the bug in question.

32371:58d4a721f0c0

static int receiveauthgrant(OscarData *od, FlapConnection *conn, aim_module_t *mod, FlapFrame *frame, aim_modsnac_t *snac, ByteStream *bs)
{
	int ret = 0;
	aim_rxcallback_t userfunc;
	guint16 tmp;
	char *bn, *msg;

	/* Read buddy name */
	if ((tmp = byte_stream_get8(bs)))
		bn = byte_stream_getstr(bs, tmp);
	else
		bn = NULL;

	/* Read message (null terminated) */
	if ((tmp = byte_stream_get16(bs)))
		msg = byte_stream_getstr(bs, tmp);
	else
		msg = NULL;

	/* Unknown */
	tmp = byte_stream_get16(bs);

static int receiveauthrequest(OscarData *od, FlapConnection *conn, aim_module_t *mod, FlapFrame *frame, aim_modsnac_t *snac, ByteStream *bs)
{
	int ret = 0;
	aim_rxcallback_t userfunc;
	guint16 tmp;
	char *bn, *msg;

	/* Read buddy name */
	if ((tmp = byte_stream_get8(bs)))
		bn = byte_stream_getstr(bs, tmp);
	else
		bn = NULL;

	/* Read message (null terminated) */
	if ((tmp = byte_stream_get16(bs)))
		msg = byte_stream_getstr(bs, tmp);
	else
		msg = NULL;

	/* Unknown */
	tmp = byte_stream_get16(bs);

{
	int ret = 0;
	aim_rxcallback_t userfunc;
	guint16 tmp;
	guint8 reply;
	char *bn, *msg;

	/* Read buddy name */
	if ((tmp = byte_stream_get8(bs)))
		bn = byte_stream_getstr(bs, tmp);
	else
		bn = NULL;

	/* Read reply */
	reply = byte_stream_get8(bs);

	/* Read message (null terminated) */
	if ((tmp = byte_stream_get16(bs)))
		msg = byte_stream_getstr(bs, tmp);
	else
		msg = NULL;

	/* Unknown */
	tmp = byte_stream_get16(bs);

	aim_rxcallback_t userfunc;
	guint16 tmp;
	char *bn;

	/* Read buddy name */
	if ((tmp = byte_stream_get8(bs)))
		bn = byte_stream_getstr(bs, tmp);
	else
		bn = NULL;

	if ((userfunc = aim_callhandler(od, snac->family, snac->subtype)))
		ret = userfunc(od, conn, frame, bn);

	g_free(bn);

32376:82024b6ea465

static int receiveauthgrant(OscarData *od, FlapConnection *conn, aim_module_t *mod, FlapFrame *frame, aim_modsnac_t *snac, ByteStream *bs)
{
	int ret = 0;
	aim_rxcallback_t userfunc;
	guint16 tmp;
	char *bn, *msg, *tmpstr;

	/* Read buddy name */
	tmp = byte_stream_get8(bs);
	if (!tmp) {
		purple_debug_warning("oscar", "Dropping auth grant SNAC "
				"because username was empty\n");
		return 0;
	}
	bn = byte_stream_getstr(bs, tmp);
	if (!g_utf8_validate(bn, -1, NULL)) {
		purple_debug_warning("oscar", "Dropping auth grant SNAC "
				"because the username was not valid UTF-8\n");
		g_free(bn);
	}

	/* Read message */
	tmp = byte_stream_get16(bs);
	if (tmp) {
		msg = byte_stream_getstr(bs, tmp);
		if (!g_utf8_validate(msg, -1, NULL)) {
			/* Ugh, msg isn't UTF8.  Let's salvage. */
			purple_debug_warning("oscar", "Got non-UTF8 message in auth "
					"grant from %s\n", bn);
			tmpstr = purple_utf8_salvage(msg);
			g_free(msg);
			msg = tmpstr;
		}
	} else
		msg = NULL;

	/* Unknown */
	tmp = byte_stream_get16(bs);

static int receiveauthrequest(OscarData *od, FlapConnection *conn, aim_module_t *mod, FlapFrame *frame, aim_modsnac_t *snac, ByteStream *bs)
{
	int ret = 0;
	aim_rxcallback_t userfunc;
	guint16 tmp;
	char *bn, *msg, *tmpstr;

	/* Read buddy name */
	tmp = byte_stream_get8(bs);
	if (!tmp) {
		purple_debug_warning("oscar", "Dropping auth request SNAC "
				"because username was empty\n");
		return 0;
	}
	bn = byte_stream_getstr(bs, tmp);
	if (!g_utf8_validate(bn, -1, NULL)) {
		purple_debug_warning("oscar", "Dropping auth request SNAC "
				"because the username was not valid UTF-8\n");
		g_free(bn);
	}

	/* Read message */
	tmp = byte_stream_get16(bs);
	if (tmp) {
		msg = byte_stream_getstr(bs, tmp);
		if (!g_utf8_validate(msg, -1, NULL)) {
			/* Ugh, msg isn't UTF8.  Let's salvage. */
			purple_debug_warning("oscar", "Got non-UTF8 message in auth "
					"request from %s\n", bn);
			tmpstr = purple_utf8_salvage(msg);
			g_free(msg);
			msg = tmpstr;
		}
	} else
		msg = NULL;

	/* Unknown */
	tmp = byte_stream_get16(bs);

{
	int ret = 0;
	aim_rxcallback_t userfunc;
	guint16 tmp;
	guint8 reply;
	char *bn, *msg, *tmpstr;

	/* Read buddy name */
	tmp = byte_stream_get8(bs);
	if (!tmp) {
		purple_debug_warning("oscar", "Dropping auth reply SNAC "
				"because username was empty\n");
		return 0;
	}
	bn = byte_stream_getstr(bs, tmp);
	if (!g_utf8_validate(bn, -1, NULL)) {
		purple_debug_warning("oscar", "Dropping auth reply SNAC "
				"because the username was not valid UTF-8\n");
		g_free(bn);
	}

	/* Read reply */
	reply = byte_stream_get8(bs);

	/* Read message */
	tmp = byte_stream_get16(bs);
	if (tmp) {
		msg = byte_stream_getstr(bs, tmp);
		if (!g_utf8_validate(msg, -1, NULL)) {
			/* Ugh, msg isn't UTF8.  Let's salvage. */
			purple_debug_warning("oscar", "Got non-UTF8 message in auth "
					"reply from %s\n", bn);
			tmpstr = purple_utf8_salvage(msg);
			g_free(msg);
			msg = tmpstr;
		}
	} else
		msg = NULL;

	/* Unknown */
	tmp = byte_stream_get16(bs);

	aim_rxcallback_t userfunc;
	guint16 tmp;
	char *bn;

	/* Read buddy name */
	tmp = byte_stream_get8(bs);
	if (!tmp) {
		purple_debug_warning("oscar", "Dropping 'you were added' SNAC "
				"because username was empty\n");
		return 0;
	}
	bn = byte_stream_getstr(bs, tmp);
	if (!g_utf8_validate(bn, -1, NULL)) {
		purple_debug_warning("oscar", "Dropping 'you were added' SNAC "
				"because the username was not valid UTF-8\n");
		g_free(bn);
	}

	if ((userfunc = aim_callhandler(od, snac->family, snac->subtype)))
		ret = userfunc(od, conn, frame, bn);

	g_free(bn);