diff options
| author | Milan Crha <mcrha@redhat.com> | 2008-10-17 08:06:15 +0000 |
|---|---|---|
| committer | Bharath Acharya <abharath@src.gnome.org> | 2008-10-17 08:06:15 +0000 |
| commit | 5450ce2eaa2195ade8a21c29c24748a80be25483 (patch) | |
| tree | face69e1df7306bfa4c34dfb02f50222321c67f3 /servers | |
| parent | 4663f47451132d1db0106eba2fb8cf92546d5f90 (diff) | |
| download | evolution-data-server-5450ce2eaa2195ade8a21c29c24748a80be25483.tar.gz | |
** Part of fix for bug #547243
2008-10-03 Milan Crha <mcrha@redhat.com>
** Part of fix for bug #547243
* e-gw-item.c: (e_gw_item_new_from_soap_parameter):
* e-gw-connection.c: (e_gw_connection_get_attachment),
(e_gw_connection_get_attachment_base64):
Check for correct values to prevent invalid reads.
svn path=/trunk/; revision=9684
Diffstat (limited to 'servers')
| -rw-r--r-- | servers/groupwise/ChangeLog | 9 | ||||
| -rw-r--r-- | servers/groupwise/e-gw-connection.c | 11 | ||||
| -rw-r--r-- | servers/groupwise/e-gw-item.c | 2 |
3 files changed, 19 insertions, 3 deletions
diff --git a/servers/groupwise/ChangeLog b/servers/groupwise/ChangeLog index 6f67486f6..d0ab1572b 100644 --- a/servers/groupwise/ChangeLog +++ b/servers/groupwise/ChangeLog @@ -1,3 +1,12 @@ +2008-10-03 Milan Crha <mcrha@redhat.com> + + ** Part of fix for bug #547243 + + * e-gw-item.c: (e_gw_item_new_from_soap_parameter): + * e-gw-connection.c: (e_gw_connection_get_attachment), + (e_gw_connection_get_attachment_base64): + Check for correct values to prevent invalid reads. + 2008-10-01 Milan Crha <mcrha@redhat.com> ** Part of fix for bug #511947 diff --git a/servers/groupwise/e-gw-connection.c b/servers/groupwise/e-gw-connection.c index 732cd144a..458d94f2a 100644 --- a/servers/groupwise/e-gw-connection.c +++ b/servers/groupwise/e-gw-connection.c @@ -2726,10 +2726,13 @@ e_gw_connection_get_attachment (EGwConnection *cnc, const char *id, int offset, buffer = soup_soap_parameter_get_string_value (param) ; } - if (buffer && buf_length) { + if (buffer && buf_length && atoi (buf_length) > 0) { gsize len = atoi (buf_length) ; *attachment = g_base64_decode (buffer,&len) ; *attach_length = len ; + } else { + *attachment = NULL; + *attach_length = 0; } /* free memory */ @@ -2794,7 +2797,7 @@ e_gw_connection_get_attachment_base64 (EGwConnection *cnc, const char *id, int o buffer = soup_soap_parameter_get_string_value (param) ; } - if (buffer && buf_length) { + if (buffer && buf_length && atoi (buf_length) > 0) { int len = atoi (buf_length) ; *attachment = g_strdup (buffer); *attach_length = len; @@ -2802,6 +2805,10 @@ e_gw_connection_get_attachment_base64 (EGwConnection *cnc, const char *id, int o *offset_r = atoi (o_return); else *offset_r = 0; + } else { + *attachment = NULL; + *attach_length = 0; + *offset_r = 0; } /* free memory */ diff --git a/servers/groupwise/e-gw-item.c b/servers/groupwise/e-gw-item.c index 26d18021b..4f10e6f7a 100644 --- a/servers/groupwise/e-gw-item.c +++ b/servers/groupwise/e-gw-item.c @@ -1951,7 +1951,7 @@ e_gw_item_new_from_soap_parameter (const char *email, const char *container, Sou msg = soup_soap_parameter_get_string_value (part); length = soup_soap_parameter_get_property (part, "length"); - if (msg && length) { + if (msg && length && atoi (length) > 0) { len = atoi (length); item->priv->message = g_base64_decode (msg, &len); if (!(item->priv->message)) { |