/pidgin/main: df4d0ab7eaae: facebook-json: fixed a size overflow...
James Geboski <[email protected]>
| Newsgroups | gmane.comp.gnome.gaim.cvs |
|---|---|
| Message-ID | <[email protected]> |
Changeset: df4d0ab7eaae8edcc5f1bc8fbfcd50d319586f74 Author: James Geboski <[email protected]> Date: 2015-12-21 16:35 -0500 Branch: default URL: https://hg.pidgin.im/pidgin/main/rev/df4d0ab7eaae Description: facebook-json: fixed a size overflow with string duplication Unlike json_parser_load_from_data(), g_strndup() will not handle signed sizes that are negative. This causes the size to overflow to a really large value, and in turn lead to a segmentation fault. The solution is simple: calculate the size of the data when the given size is negative. This bug was introduced by 7f8a2f301a82. diffstat: libpurple/protocols/facebook/json.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diffs (19 lines): diff --git a/libpurple/protocols/facebook/json.c b/libpurple/protocols/facebook/json.c --- a/libpurple/protocols/facebook/json.c +++ b/libpurple/protocols/facebook/json.c @@ -262,9 +262,14 @@ fb_json_node_new(const gchar *data, gssi JsonNode *root; JsonParser *prsr; + g_return_val_if_fail(data != NULL, NULL); + + if (size < 0) { + size = strlen(data); + } + /* Ensure data is null terminated for json-glib < 1.0.2 */ slice = g_strndup(data, size); - prsr = json_parser_new(); if (!json_parser_load_from_data(prsr, slice, size, error)) { _______________________________________________ Commits mailing list [email protected] https://pidgin.im/cgi-bin/mailman/listinfo/commits