view valgrind-suppressions @ 30273:6829b27ee4c8

This patch attempts to fix four bugs in the oscar protocol plugin that were introduced with the X-Status code in Pidgin 2.7.0. Problem #1 (the remotely-triggerable crash): The crash happens when a buddy sets an xstatus message containing <desc> but no closing </desc>, or <title> but no closing </title>. The fix is to check the result of strstr(closing_tag_name) and do nothing if it is NULL. This is CVE-2010-2528. Problem #2: Fixes potential incorrect parsing of the xstatus string that could result in an incorrect message being displayed to the libpurple user. Happens if an xstatus message contains </desc> before <desc>, or </title> before <title>. The fix is to start looking for the closing tag at the end of the beginning tag rather than at the beginning of the xstatus xml. Probably not a security problem, but definitely a bug. Problem #3: Fixes potential incorrect parsing of the xstatus string that could result in the title not being shown to the libpurple user. Happens if the close title tag appears after the desc tag in the xstatus xml, because we add a null character at the beginning of the close title tag, so strstr() for the desc tag would stop searching there. Probably not a security problem, but definitely a bug. Problem #4: Fixes potential incorrect display of the xstatus string that could result in an incorrect message being displayed to the libpurple user. Happens because we reusing the 'xml' string when preparing the string for the user, but we copy values from xml to xml. If those values overlap with themselves or with each other then an incorrect value could be displayed. Probably not a security problem, but definitely a bug.

{
   X oddness 1
   Memcheck:Param
   write(buf)
   fun:__write_nocancel
   fun:_X11TransWrite
   obj:/usr/X11R6/lib/libX11.so.6.2
   fun:_XReply
}
{
   NSS
   Memcheck:Cond
   obj:/usr/lib/libsoftokn3.so
   obj:/usr/lib/libsoftokn3.so
   obj:/usr/lib/libsoftokn3.so
   obj:/usr/lib/libsoftokn3.so
}
{
   X oddness 2
   Memcheck:Param
   writev(vector[...])
   fun:writev
   obj:/usr/X11R6/lib/libX11.so.6.2
   fun:_X11TransWritev
   fun:_XSend
}
{
   X oddness 3
   Memcheck:Cond
   fun:XcursorImageHash
   fun:XcursorNoticePutBitmap
   fun:_XNoticePutBitmap
   fun:XPutImage
}
{
   X oddness 4
   Memcheck:Param
   write(buf)
   fun:__write_nocancel
   fun:_X11TransWrite
   obj:/usr/X11R6/lib/libX11.so.6.2
   fun:XFlush
}
{
   X oddness 5
   Memcheck:Param
   write(buf)
   fun:__write_nocancel
   fun:_X11TransWrite
   obj:/usr/X11R6/lib/libX11.so.6.2
   fun:XDrawLine
}
{
   X oddness 6
   Memcheck:Param
   write(buf)
   fun:__write_nocancel
   fun:_X11TransWrite
   obj:/usr/X11R6/lib/libX11.so.6.2
   fun:_XEventsQueued
}
{
   File selector
   Memcheck:Value4
   fun:_itoa_word
   fun:_IO_vfprintf_internal
   fun:_IO_vsprintf_internal
   fun:_IO_sprintf
}
{
   File selector 2
   Memcheck:Param
   write(buf)
   fun:__write_nocancel
   fun:_X11TransWrite
   obj:/usr/X11R6/lib/libX11.so.6.2
   fun:XRenderComposite
}
{
   TCL leak
   Memcheck:Leak
   fun:malloc
   fun:TclpAlloc
   fun:Tcl_Alloc
   fun:Tcl_StaticPackage
}
{
   FontConfig Maybe
   Memcheck:Leak
   fun:malloc
   fun:FcStrCopy
   fun:FcStrSetAdd
   fun:FcLangSetCopy
}
{
   File selector 3
   Memcheck:Param
   write(buf)
   fun:__write_nocancel
   fun:_X11TransWrite
   obj:/usr/X11R6/lib/libX11.so.6.2
   fun:_XFlushGCCache
}
{
   File selector 4
   Memcheck:Param
   write(buf)
   fun:__write_nocancel
   fun:_X11TransWrite
   obj:/usr/X11R6/lib/libX11.so.6.2
   fun:XCreateGC
}
{
   Something else
   Memcheck:Param
   write(buf)
   fun:__write_nocancel
   fun:_X11TransWrite
   obj:/usr/X11R6/lib/libX11.so.6.2
   fun:_XSetClipRectangles
}
{
   New conversation windows
   Memcheck:Cond
   obj:/usr/lib/libgtk-x11-2.0.so.0.400.14
   obj:/usr/lib/libgtk-x11-2.0.so.0.400.14
   obj:/usr/lib/libgtk-x11-2.0.so.0.400.14
   obj:/usr/lib/libgtk-x11-2.0.so.0.400.14
}
{
   New conversation windows 2
   Memcheck:Cond
   obj:/usr/lib/libgtk-x11-2.0.so.0.400.14
   obj:/usr/lib/libgtk-x11-2.0.so.0.400.14
   obj:/usr/lib/libgtk-x11-2.0.so.0.400.14
   obj:/usr/lib/libgobject-2.0.so.0.400.8
}
{
   NSS Init
   Memcheck:Leak
   fun:malloc
   fun:PR_Malloc
   fun:PR_CreateStack
   fun:_PR_InitFdCache
   fun:_PR_InitIO
   fun:_PR_ImplicitInitialization
   fun:PR_Init
   fun:rsa_nss_init
   fun:GE_plugin_load
   fun:purple_plugin_load
   fun:purple_plugins_load_saved
   fun:main
}