Merged TALOS-CAN-0133

2 files changed, 17 insertions, 6 deletions

diff --git a/ChangeLog b/ChangeLog
index b9ffab1d4f..b93cc7d03a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -28,6 +28,9 @@ version 2.10.13 (MM/DD/YY):
 	  (TALOS-CAN-0123)
 	* Fixed a directory traversal issue.  Discovered by Yves Younan of Cisco
 	  Talos (TALOS-CAN-0128)
+	* Fixed a remote denial of service vulnerability that could result in
+	  a null pointer dereference.  Discovered by Yves Younan of Cisco Talos.
+	  (TALOS-CAN-0133)
 
 version 2.10.12 (12/31/15):
 	General:
diff --git a/libpurple/protocols/mxit/formcmds.c b/libpurple/protocols/mxit/formcmds.c
index 0e60a6a02a..ad7681aafa 100644
--- a/libpurple/protocols/mxit/formcmds.c
+++ b/libpurple/protocols/mxit/formcmds.c
@@ -395,6 +395,9 @@ static void command_imagestrip(struct MXitSession* session, const char* from, GH
 	/* validator */
 	validator = g_hash_table_lookup(hash, "v");
 
+	if (!name || !validator)
+		return;
+
 	/* image data */
 	tmp = g_hash_table_lookup(hash, "dat");
 	if (tmp) {
@@ -430,13 +433,13 @@ static void command_imagestrip(struct MXitSession* session, const char* from, GH
 	}
 
 	tmp = g_hash_table_lookup(hash, "fw");
-	width = atoi(tmp);
+	width = (tmp ? atoi(tmp) : 0);
 
 	tmp = g_hash_table_lookup(hash, "fh");
-	height = atoi(tmp);
+	height = (tmp ? atoi(tmp) : 0);
 
 	tmp = g_hash_table_lookup(hash, "layer");
-	layer = atoi(tmp);
+	layer = (tmp ? atoi(tmp) : 0);
 
 	purple_debug_info(MXIT_PLUGIN_ID, "ImageStrip %s from %s: [w=%i h=%i l=%i validator=%s]\n", name, from, width, height, layer, validator);
 }
@@ -525,21 +528,26 @@ static void command_table(struct RXMsgData* mx, GHashTable* hash)
 
 	/* table name */
 	name = g_hash_table_lookup(hash, "nm");
+	if (!name)
+		return;
 
 	/* number of columns */
 	tmp = g_hash_table_lookup(hash, "col");
-	nr_columns = atoi(tmp);
+	nr_columns = (tmp ? atoi(tmp) : 0);
 
 	/* number of rows */
 	tmp = g_hash_table_lookup(hash, "row");
-	nr_rows = atoi(tmp);
+	nr_rows = (tmp ? atoi(tmp) : 0);
 
 	/* mode */
 	tmp = g_hash_table_lookup(hash, "mode");
-	mode = atoi(tmp);
+	mode = (tmp ? atoi(tmp) : 0);
 
 	/* table data */
 	tmp = g_hash_table_lookup(hash, "d");
+	if (!tmp)
+		tmp = "";
+
 	coldata = g_strsplit(tmp, "~", 0);			/* split into entries for each row & column */
 
 	purple_debug_info(MXIT_PLUGIN_ID, "Table %s from %s: [cols=%i rows=%i mode=%i]\n", name, mx->from, nr_columns, nr_rows, mode);