Mercurial > pidgin
changeset 10595:de34037a02c7
[gaim-migrate @ 12010]
Forward port some other stuff from oldstatus
committer: Tailor Script <tailor@pidgin.im>
| author | Mark Doliner <mark@kingant.net> |
|---|---|
| date | Mon, 14 Feb 2005 03:07:06 +0000 |
| parents | a78d9fac8183 |
| children | 913ec44675c3 |
| files | src/protocols/oscar/aim.h src/protocols/oscar/bstream.c src/protocols/oscar/icq.c src/protocols/oscar/im.c src/protocols/oscar/oscar.c |
| diffstat | 5 files changed, 54 insertions(+), 15 deletions(-) [+] |
line wrap: on
line diff
--- a/src/protocols/oscar/aim.h Mon Feb 14 03:02:36 2005 +0000 +++ b/src/protocols/oscar/aim.h Mon Feb 14 03:07:06 2005 +0000 @@ -716,7 +716,7 @@ } aim_mpmsg_section_t; typedef struct aim_mpmsg_s { - int numparts; + unsigned int numparts; aim_mpmsg_section_t *parts; } aim_mpmsg_t; @@ -751,8 +751,8 @@ fu32_t iconsum; /* Only used if AIM_IMFLAGS_CUSTOMFEATURES is set */ + fu16_t featureslen; fu8_t *features; - fu8_t featureslen; /* Only used if AIM_IMFLAGS_CUSTOMCHARSET is set and mpmsg not used */ fu16_t charset;
--- a/src/protocols/oscar/bstream.c Mon Feb 14 03:02:36 2005 +0000 +++ b/src/protocols/oscar/bstream.c Mon Feb 14 03:07:06 2005 +0000 @@ -49,10 +49,15 @@ return; } +/* + * N can be negative, which can be used for going backwards + * in a bstream. I'm not sure if libfaim actually does + * this anywhere... + */ faim_internal int aim_bstream_advance(aim_bstream_t *bs, int n) { - if (aim_bstream_empty(bs) < n) + if ((aim_bstream_curpos(bs) + n < 0) || (aim_bstream_empty(bs) < n)) return 0; /* XXX throw an exception */ bs->offset += n;
--- a/src/protocols/oscar/icq.c Mon Feb 14 03:02:36 2005 +0000 +++ b/src/protocols/oscar/icq.c Mon Feb 14 03:07:06 2005 +0000 @@ -117,8 +117,8 @@ } /** - * I don't know why we have this function and the one above... - * Maybe one of them is wrong? Maybe they both really DO exist? + * I'm not really sure what the difference is between this function + * and the one above. They both definitely exist. */ faim_export int aim_icq_setauthsetting(aim_session_t *sess, int auth_required) { @@ -152,7 +152,7 @@ aimbs_putle8(&fr->data, auth_required); aimbs_putle8(&fr->data, 0x0c); aimbs_putle16(&fr->data, 0x0103); - aimbs_putle16(&fr->data, 0x0000); + aimbs_putle16(&fr->data, 0x0000); /* web enabled or not! */ aim_tx_enqueue(sess, fr);
--- a/src/protocols/oscar/im.c Mon Feb 14 03:02:36 2005 +0000 +++ b/src/protocols/oscar/im.c Mon Feb 14 03:07:06 2005 +0000 @@ -248,7 +248,7 @@ return -EINVAL; if (args->flags & AIM_IMFLAGS_MULTIPART) { - if (args->mpmsg->numparts <= 0) + if (args->mpmsg->numparts == 0) return -EINVAL; } else { if (!args->msg || (args->msglen <= 0)) @@ -1332,6 +1332,11 @@ /* Message string length, including character set info. */ msglen = aimbs_get16(&mbs); + if (msglen > aim_bstream_empty(&mbs)) + { + faimdprintf(sess, 0, "Received an IM containing an invalid message part from %s. They are probably trying to do something malicious."); + break; + } /* Character set info */ flag1 = aimbs_get16(&mbs); @@ -1411,7 +1416,7 @@ aim_rxcallback_t userfunc; int ret = 0; struct aim_incomingim_ch1_args args; - int endpos; + unsigned int endpos; memset(&args, 0, sizeof(args)); @@ -1422,11 +1427,17 @@ * I've changed it to process the TLVs in-place. This avoids lots * of per-IM memory allocations. */ - while (aim_bstream_empty(bs)) { - + while (aim_bstream_empty(bs)) + { type = aimbs_get16(bs); length = aimbs_get16(bs); + if (length > aim_bstream_empty(bs)) + { + faimdprintf(sess, 0, "Received an IM containing an invalid message part from %s. They are probably trying to do something malicious.\n", userinfo->sn); + break; + } + endpos = aim_bstream_curpos(bs) + length; if (type == 0x0002) { /* Message Block */ @@ -1444,10 +1455,20 @@ aimbs_get8(bs); /* 01 */ args.featureslen = aimbs_get16(bs); - /* XXX XXX this is all evil! */ - args.features = bs->data + bs->offset; - aim_bstream_advance(bs, args.featureslen); - args.icbmflags |= AIM_IMFLAGS_CUSTOMFEATURES; + if (args.featureslen > aim_bstream_empty(bs)) + { + faimdprintf(sess, 0, "Received an IM containing an invalid message part from %s. They are probably trying to do something malicious.\n", userinfo->sn); + break; + } + if (args.featureslen == 0) + { + args.features = NULL; + } + else + { + args.features = aimbs_getraw(bs, args.featureslen); + args.icbmflags |= AIM_IMFLAGS_CUSTOMFEATURES; + } /* * The rest of the TLV contains one or more message @@ -1498,8 +1519,17 @@ } else if (type == 0x0017) { + free(args.extdata); args.extdatalen = length; - args.extdata = aimbs_getraw(bs, args.extdatalen); + if (args.extdatalen > aim_bstream_empty(bs)) + { + faimdprintf(sess, 0, "Received an IM containing an invalid message part from %s. They are probably trying to do something malicious.\n", userinfo->sn); + break; + } + if (args.extdatalen == 0) + args.extdata = NULL; + else + args.extdata = aimbs_getraw(bs, args.extdatalen); } else { faimdprintf(sess, 0, "incomingim_ch1: unknown TLV 0x%04x (len %d)\n", type, length); @@ -1521,6 +1551,7 @@ ret = userfunc(sess, rx, channel, userinfo, &args); aim_mpmsg_free(sess, &args.mpmsg); + free(args.features); free(args.extdata); return ret;
--- a/src/protocols/oscar/oscar.c Mon Feb 14 03:02:36 2005 +0000 +++ b/src/protocols/oscar/oscar.c Mon Feb 14 03:07:06 2005 +0000 @@ -3332,6 +3332,9 @@ gaim_debug_misc("oscar", "Received IM from %s with %d parts\n", userinfo->sn, args->mpmsg.numparts); + if (args->mpmsg.numparts == 0) + return 1; + bi = g_hash_table_lookup(od->buddyinfo, gaim_normalize(account, userinfo->sn)); if (!bi) { bi = g_new0(struct buddyinfo, 1);