# HG changeset patch
# User Mark Doliner <mark@kingant.net>
# Date 1336360688 0
# Node ID aacfb71133cc8eafd2a4b88d87143e0c1b957e87
# Parent  5ae7e1f36b43aa0333b2f5c2d4bdafd54ae97449
Fix a possible MSN remote crash

Incoming messages with certain characters or character encodings
can cause clients to crash.  The fix is for the contents of all
incoming plaintext messages are converted to UTF-8 and validated
before used.

This was reported to us by Fabian Yamaguchi and this patch was written
by Elliott Sales de Andrade (maybe with small, insignificant changes by me)

diff -r 5ae7e1f36b43 -r aacfb71133cc libpurple/protocols/msn/msg.c
--- a/libpurple/protocols/msn/msg.c	Mon May 07 03:16:31 2012 +0000
+++ b/libpurple/protocols/msn/msg.c	Mon May 07 03:18:08 2012 +0000
@@ -257,13 +257,47 @@
 		msg->body[msg->body_len] = '\0';
 	}
 
-	if ((!content_type || !strcmp(content_type, "text/plain"))
-			&& msg->charset == NULL) {
-		char *body = g_convert(msg->body, msg->body_len, "UTF-8",
-				"ISO-8859-1", NULL, &msg->body_len, NULL);
-		g_free(msg->body);
-		msg->body = body;
-		msg->charset = g_strdup("UTF-8");
+	if (msg->body && content_type && purple_str_has_prefix(content_type, "text/")) {
+		char *body = NULL;
+
+		if (msg->charset == NULL || g_str_equal(msg->charset, "UTF-8")) {
+			/* Charset is UTF-8 */
+			if (!g_utf8_validate(msg->body, msg->body_len, NULL)) {
+				purple_debug_warning("msn", "Message contains invalid "
+						"UTF-8. Attempting to salvage.\n");
+				body = purple_utf8_salvage(msg->body);
+				payload_len = strlen(body);
+			}
+		} else {
+			/* Charset is something other than UTF-8 */
+			GError *err = NULL;
+			body = g_convert(msg->body, msg->body_len, "UTF-8",
+					msg->charset, NULL, &payload_len, &err);
+			if (!body || err) {
+				purple_debug_warning("msn", "Unable to convert message from "
+						"%s to UTF-8: %s\n", msg->charset,
+						err ? err->message : "Unknown error");
+				if (err)
+					g_error_free(err);
+
+				/* Fallback to ISO-8859-1 */
+				g_free(body);
+				body = g_convert(msg->body, msg->body_len, "UTF-8",
+						"ISO-8859-1", NULL, &payload_len, NULL);
+				if (!body) {
+					g_free(msg->body);
+					msg->body = NULL;
+					msg->body_len = 0;
+				}
+			}
+		}
+
+		if (body) {
+			g_free(msg->body);
+			msg->body = body;
+			msg->body_len = payload_len;
+			msn_message_set_charset(msg, "UTF-8");
+		}
 	}
 
 	g_free(tmp_base);