Mercurial > pidgin
view libpurple/protocols/msn/slpcall.c @ 24475:caf82c1cebf2
I've seen this crash a few times where cmd->param_count is 4 and
we try to access params[4] which is invalid.
The backtrace is:
#0 0x0000003c4c4341ca in ____strtoll_l_internal () from /lib64/libc.so.6
#1 0x0000003c4c431ab2 in atoi () from /lib64/libc.so.6
#2 0x00000000005f0abe in ubm_cmd (cmdproc=0xc86eb30, cmd=0xc832e00) at notification.c:494
#3 0x00000000005efef1 in msn_cmdproc_process_cmd (cmdproc=0xc86eb30, cmd=0xc832e00)
at cmdproc.c:321
#4 0x00000000005eff97 in msn_cmdproc_process_cmd_text (cmdproc=0xc86eb30,
command=0xcadb390 "UBM somebody1@yahoo.com 32 1 170") at cmdproc.c:343
#5 0x00000000005f9d8f in read_cb (data=0xc86ea90, source=9, cond=PURPLE_INPUT_READ)
at servconn.c:439
#6 0x00000000004db70c in pidgin_io_invoke (source=0xc8369f0, condition=G_IO_IN, data=0xc836570)
at gtkeventloop.cc:79
Here are some other values I've seen for command in frame 4:
UBM somebody1@yahoo.com 32 1 170
UBM somebody2@yahoo.com 32 2 91
UBM somebody3@yahoo.com 32 2 93
author | Mark Doliner <mark@kingant.net> |
---|---|
date | Tue, 18 Nov 2008 07:16:49 +0000 |
parents | bceefbae1ca6 |
children | bcedd3b2ca69 |
line wrap: on
line source
/** * @file slpcall.c SLP Call Functions * * purple * * Purple is the legal property of its developers, whose names are too numerous * to list here. Please refer to the COPYRIGHT file distributed with this * source distribution. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02111-1301 USA */ #include "msn.h" #include "msnutils.h" #include "slpcall.h" #include "slp.h" /* #define MSN_DEBUG_SLPCALL */ /************************************************************************** * Main **************************************************************************/ static gboolean msn_slpcall_timeout(gpointer data) { MsnSlpCall *slpcall; slpcall = data; #ifdef MSN_DEBUG_SLPCALL purple_debug_info("msn", "slpcall_timeout: slpcall(%p)\n", slpcall); #endif if (!slpcall->pending && !slpcall->progress) { msn_slpcall_destroy(slpcall); return FALSE; } slpcall->progress = FALSE; return TRUE; } MsnSlpCall * msn_slpcall_new(MsnSlpLink *slplink) { MsnSlpCall *slpcall; g_return_val_if_fail(slplink != NULL, NULL); slpcall = g_new0(MsnSlpCall, 1); #ifdef MSN_DEBUG_SLPCALL purple_debug_info("msn", "slpcall_new: slpcall(%p)\n", slpcall); #endif slpcall->slplink = slplink; msn_slplink_add_slpcall(slplink, slpcall); slpcall->timer = purple_timeout_add_seconds(MSN_SLPCALL_TIMEOUT, msn_slpcall_timeout, slpcall); return slpcall; } void msn_slpcall_destroy(MsnSlpCall *slpcall) { GList *e; #ifdef MSN_DEBUG_SLPCALL purple_debug_info("msn", "slpcall_destroy: slpcall(%p)\n", slpcall); #endif g_return_if_fail(slpcall != NULL); if (slpcall->timer) purple_timeout_remove(slpcall->timer); for (e = slpcall->slplink->slp_msgs; e != NULL; ) { MsnSlpMessage *slpmsg = e->data; e = e->next; #ifdef MSN_DEBUG_SLPCALL_VERBOSE purple_debug_info("msn", "slpcall_destroy: trying slpmsg(%p)\n", slpmsg); #endif if (slpmsg->slpcall == slpcall) { msn_slpmsg_destroy(slpmsg); } } if (slpcall->end_cb != NULL) slpcall->end_cb(slpcall, slpcall->slplink->session); if (slpcall->xfer != NULL) { slpcall->xfer->data = NULL; purple_xfer_unref(slpcall->xfer); } msn_slplink_remove_slpcall(slpcall->slplink, slpcall); g_free(slpcall->id); g_free(slpcall->branch); g_free(slpcall->data_info); g_free(slpcall); } void msn_slpcall_init(MsnSlpCall *slpcall, MsnSlpCallType type) { slpcall->session_id = rand() % 0xFFFFFF00 + 4; slpcall->id = rand_guid(); slpcall->type = type; } void msn_slpcall_session_init(MsnSlpCall *slpcall) { if (slpcall->session_init_cb) slpcall->session_init_cb(slpcall); slpcall->started = TRUE; } void msn_slpcall_invite(MsnSlpCall *slpcall, const char *euf_guid, int app_id, const char *context) { MsnSlpLink *slplink; MsnSlpMessage *slpmsg; char *header; char *content; g_return_if_fail(slpcall != NULL); g_return_if_fail(context != NULL); slplink = slpcall->slplink; slpcall->branch = rand_guid(); content = g_strdup_printf( "EUF-GUID: {%s}\r\n" "SessionID: %lu\r\n" "AppID: %d\r\n" "Context: %s\r\n\r\n", euf_guid, slpcall->session_id, app_id, context); header = g_strdup_printf("INVITE MSNMSGR:%s MSNSLP/1.0", slplink->remote_user); slpmsg = msn_slpmsg_sip_new(slpcall, 0, header, slpcall->branch, "application/x-msnmsgr-sessionreqbody", content); #ifdef MSN_DEBUG_SLP slpmsg->info = "SLP INVITE"; slpmsg->text_body = TRUE; #endif msn_slplink_send_slpmsg(slplink, slpmsg); g_free(header); g_free(content); } void msn_slpcall_close(MsnSlpCall *slpcall) { g_return_if_fail(slpcall != NULL); g_return_if_fail(slpcall->slplink != NULL); send_bye(slpcall, "application/x-msnmsgr-sessionclosebody"); msn_slplink_send_queued_slpmsgs(slpcall->slplink); msn_slpcall_destroy(slpcall); } MsnSlpCall * msn_slp_process_msg(MsnSlpLink *slplink, MsnSlpMessage *slpmsg) { MsnSlpCall *slpcall; const guchar *body; gsize body_len; slpcall = NULL; body = slpmsg->buffer; body_len = slpmsg->size; if (slpmsg->flags == 0x0) { char *body_str; body_str = g_strndup((const char *)body, body_len); slpcall = msn_slp_sip_recv(slplink, body_str); g_free(body_str); } else if (slpmsg->flags == 0x20 || slpmsg->flags == 0x1000030) { slpcall = msn_slplink_find_slp_call_with_session_id(slplink, slpmsg->session_id); if (slpcall != NULL) { if (slpcall->timer) purple_timeout_remove(slpcall->timer); slpcall->cb(slpcall, body, body_len); slpcall->wasted = TRUE; } } #if 0 else if (slpmsg->flags == 0x100) { slpcall = slplink->directconn->initial_call; if (slpcall != NULL) msn_slpcall_session_init(slpcall); } #endif return slpcall; }