Merged with default branch

2 files changed, 18 insertions, 2 deletions

diff --git a/libpurple/ciphers/des3cipher.c b/libpurple/ciphers/des3cipher.c
index 5e270e7ffc..825f33915f 100644
--- a/libpurple/ciphers/des3cipher.c
+++ b/libpurple/ciphers/des3cipher.c
@@ -112,9 +112,10 @@ purple_des3_cipher_ecb_encrypt(PurpleDES3Cipher *des3_cipher, const guchar input
 	int tmp;
 	guint8 buf[8] = {0,0,0,0,0,0,0,0};
 	ssize_t out_len;
-
 	PurpleDES3CipherPrivate *priv = PURPLE_DES3_CIPHER_GET_PRIVATE(des3_cipher);
 
+	g_return_val_if_fail(out_size >= in_len, -1);
+
 	while (offset + 8 <= in_len) {
 		purple_des_cipher_ecb_crypt(PURPLE_DES_CIPHER(priv->key1),
 									input + offset, output + offset, 0);
@@ -129,6 +130,7 @@ purple_des3_cipher_ecb_encrypt(PurpleDES3Cipher *des3_cipher, const guchar input
 	out_len = in_len;
 	if (offset < in_len) {
 		out_len += in_len - offset;
+		g_return_val_if_fail(out_size >= out_len, -1);
 		tmp = offset;
 		memset(buf, 0, 8);
 		while (tmp < in_len) {
@@ -157,9 +159,10 @@ purple_des3_cipher_cbc_encrypt(PurpleDES3Cipher *des3_cipher, const guchar input
 	guint8 buf[8];
 	ssize_t out_len;
 	PurpleDES3CipherPrivate *priv = PURPLE_DES3_CIPHER_GET_PRIVATE(des3_cipher);
-
 	memcpy(buf, priv->iv, 8);
 
+	g_return_val_if_fail(out_size >= in_len, -1);
+
 	while (offset + 8 <= in_len) {
 		for (i = 0; i < 8; i++)
 			buf[i] ^= input[offset + i];
@@ -178,6 +181,7 @@ purple_des3_cipher_cbc_encrypt(PurpleDES3Cipher *des3_cipher, const guchar input
 	out_len = in_len;
 	if (offset < in_len) {
 		out_len += in_len - offset;
+		g_return_val_if_fail(out_size >= out_len, -1);
 		tmp = offset;
 		i = 0;
 		while (tmp < in_len) {
@@ -225,6 +229,8 @@ purple_des3_cipher_ecb_decrypt(PurpleDES3Cipher *des3_cipher, const guchar input
 	ssize_t out_len;
 	PurpleDES3CipherPrivate *priv = PURPLE_DES3_CIPHER_GET_PRIVATE(des3_cipher);
 
+	g_return_val_if_fail(out_size >= in_len, -1);
+
 	while (offset + 8 <= in_len) {
 		/* NOTE: Apply key in reverse */
 		purple_des_cipher_ecb_crypt(PURPLE_DES_CIPHER(priv->key3),
@@ -240,6 +246,7 @@ purple_des3_cipher_ecb_decrypt(PurpleDES3Cipher *des3_cipher, const guchar input
 	out_len = in_len;
 	if (offset < in_len) {
 		out_len += in_len - offset;
+		g_return_val_if_fail(out_size >= out_len, -1);
 		tmp = offset;
 		memset(buf, 0, 8);
 		while (tmp < in_len) {
@@ -270,6 +277,8 @@ purple_des3_cipher_cbc_decrypt(PurpleDES3Cipher *des3_cipher, const guchar input
 	ssize_t out_len;
 	PurpleDES3CipherPrivate *priv = PURPLE_DES3_CIPHER_GET_PRIVATE(des3_cipher);
 
+	g_return_val_if_fail(out_size >= in_len, -1);
+
 	memcpy(link, priv->iv, 8);
 	while (offset + 8 <= in_len) {
 		purple_des_cipher_ecb_crypt(PURPLE_DES_CIPHER(priv->key3),
@@ -290,6 +299,7 @@ purple_des3_cipher_cbc_decrypt(PurpleDES3Cipher *des3_cipher, const guchar input
 	out_len = in_len;
 	if(offset<in_len) {
 		out_len += in_len - offset;
+		g_return_val_if_fail(out_size >= out_len, -1);
 		tmp = offset;
 		memset(buf, 0, 8);
 		i = 0;
diff --git a/libpurple/ciphers/descipher.c b/libpurple/ciphers/descipher.c
index ea6e8b0270..5460114996 100644
--- a/libpurple/ciphers/descipher.c
+++ b/libpurple/ciphers/descipher.c
@@ -433,6 +433,8 @@ purple_des_cipher_encrypt(PurpleCipher *cipher, const guchar input[],
 	guint8 buf[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
 	ssize_t out_len;
 
+	g_return_val_if_fail(out_size >= in_len, -1);
+
 	while(offset + 8 <= in_len) {
 		purple_des_cipher_ecb_crypt(des_cipher, input + offset, output + offset, 0);
 		offset += 8;
@@ -442,6 +444,7 @@ purple_des_cipher_encrypt(PurpleCipher *cipher, const guchar input[],
 
 	if(offset<in_len) {
 		out_len += in_len - offset;
+		g_return_val_if_fail(out_size >= out_len, -1);
 		tmp = offset;
 		while(tmp<in_len) {
 			buf[i++] = input[tmp];
@@ -463,6 +466,8 @@ purple_des_cipher_decrypt(PurpleCipher *cipher, const guchar input[],
 	guint8 buf[8] = {0,0,0,0,0,0,0,0};
 	ssize_t out_len;
 
+	g_return_val_if_fail(out_size >= in_len, -1);
+
 	while(offset + 8 <= in_len) {
 		purple_des_cipher_ecb_crypt(des_cipher, input + offset, output + offset, 1);
 		offset += 8;
@@ -471,6 +476,7 @@ purple_des_cipher_decrypt(PurpleCipher *cipher, const guchar input[],
 	out_len = in_len;
 	if(offset<in_len) {
 		out_len += in_len - offset;
+		g_return_val_if_fail(out_size >= out_len, -1);
 		tmp = offset;
 		while(tmp<in_len) {
 			buf[i++] = input[tmp];