Mercurial > pidgin
view valgrind-suppressions @ 30273:6829b27ee4c8
This patch attempts to fix four bugs in the oscar protocol plugin that
were introduced with the X-Status code in Pidgin 2.7.0.
Problem #1 (the remotely-triggerable crash):
The crash happens when a buddy sets an xstatus message containing <desc>
but no closing </desc>, or <title> but no closing </title>. The fix
is to check the result of strstr(closing_tag_name) and do nothing if it
is NULL. This is CVE-2010-2528.
Problem #2:
Fixes potential incorrect parsing of the xstatus string that could result
in an incorrect message being displayed to the libpurple user. Happens if
an xstatus message contains </desc> before <desc>, or </title> before
<title>. The fix is to start looking for the closing tag at the end
of the beginning tag rather than at the beginning of the xstatus xml.
Probably not a security problem, but definitely a bug.
Problem #3:
Fixes potential incorrect parsing of the xstatus string that could result
in the title not being shown to the libpurple user. Happens if the close
title tag appears after the desc tag in the xstatus xml, because we add a
null character at the beginning of the close title tag, so strstr() for
the desc tag would stop searching there. Probably not a security problem,
but definitely a bug.
Problem #4:
Fixes potential incorrect display of the xstatus string that could result
in an incorrect message being displayed to the libpurple user. Happens
because we reusing the 'xml' string when preparing the string for the user,
but we copy values from xml to xml. If those values overlap with themselves
or with each other then an incorrect value could be displayed. Probably not
a security problem, but definitely a bug.
author | Mark Doliner <mark@kingant.net> |
---|---|
date | Wed, 21 Jul 2010 02:49:23 +0000 |
parents | a8d6f071eb6d |
children |
line wrap: on
line source
{ X oddness 1 Memcheck:Param write(buf) fun:__write_nocancel fun:_X11TransWrite obj:/usr/X11R6/lib/libX11.so.6.2 fun:_XReply } { NSS Memcheck:Cond obj:/usr/lib/libsoftokn3.so obj:/usr/lib/libsoftokn3.so obj:/usr/lib/libsoftokn3.so obj:/usr/lib/libsoftokn3.so } { X oddness 2 Memcheck:Param writev(vector[...]) fun:writev obj:/usr/X11R6/lib/libX11.so.6.2 fun:_X11TransWritev fun:_XSend } { X oddness 3 Memcheck:Cond fun:XcursorImageHash fun:XcursorNoticePutBitmap fun:_XNoticePutBitmap fun:XPutImage } { X oddness 4 Memcheck:Param write(buf) fun:__write_nocancel fun:_X11TransWrite obj:/usr/X11R6/lib/libX11.so.6.2 fun:XFlush } { X oddness 5 Memcheck:Param write(buf) fun:__write_nocancel fun:_X11TransWrite obj:/usr/X11R6/lib/libX11.so.6.2 fun:XDrawLine } { X oddness 6 Memcheck:Param write(buf) fun:__write_nocancel fun:_X11TransWrite obj:/usr/X11R6/lib/libX11.so.6.2 fun:_XEventsQueued } { File selector Memcheck:Value4 fun:_itoa_word fun:_IO_vfprintf_internal fun:_IO_vsprintf_internal fun:_IO_sprintf } { File selector 2 Memcheck:Param write(buf) fun:__write_nocancel fun:_X11TransWrite obj:/usr/X11R6/lib/libX11.so.6.2 fun:XRenderComposite } { TCL leak Memcheck:Leak fun:malloc fun:TclpAlloc fun:Tcl_Alloc fun:Tcl_StaticPackage } { FontConfig Maybe Memcheck:Leak fun:malloc fun:FcStrCopy fun:FcStrSetAdd fun:FcLangSetCopy } { File selector 3 Memcheck:Param write(buf) fun:__write_nocancel fun:_X11TransWrite obj:/usr/X11R6/lib/libX11.so.6.2 fun:_XFlushGCCache } { File selector 4 Memcheck:Param write(buf) fun:__write_nocancel fun:_X11TransWrite obj:/usr/X11R6/lib/libX11.so.6.2 fun:XCreateGC } { Something else Memcheck:Param write(buf) fun:__write_nocancel fun:_X11TransWrite obj:/usr/X11R6/lib/libX11.so.6.2 fun:_XSetClipRectangles } { New conversation windows Memcheck:Cond obj:/usr/lib/libgtk-x11-2.0.so.0.400.14 obj:/usr/lib/libgtk-x11-2.0.so.0.400.14 obj:/usr/lib/libgtk-x11-2.0.so.0.400.14 obj:/usr/lib/libgtk-x11-2.0.so.0.400.14 } { New conversation windows 2 Memcheck:Cond obj:/usr/lib/libgtk-x11-2.0.so.0.400.14 obj:/usr/lib/libgtk-x11-2.0.so.0.400.14 obj:/usr/lib/libgtk-x11-2.0.so.0.400.14 obj:/usr/lib/libgobject-2.0.so.0.400.8 } { NSS Init Memcheck:Leak fun:malloc fun:PR_Malloc fun:PR_CreateStack fun:_PR_InitFdCache fun:_PR_InitIO fun:_PR_ImplicitInitialization fun:PR_Init fun:rsa_nss_init fun:GE_plugin_load fun:purple_plugin_load fun:purple_plugins_load_saved fun:main }