Changeset 9698fc0

Timestamp:

2016-10-12T08:12:41Z (8 years ago)

Author:

dequis <dx@…>

Branches:

master

Children:

a08b2db

Parents:

01d56c0

git-author:

dequis <dx@…> (12-10-16 08:07:25)

git-committer:

dequis <dx@…> (12-10-16 08:12:41)

Message:

jabber: Don't pass a readonly empty string to imcb_chat_topic()

Fixes crashes when a topic is unset and strip_html is set to always.
Turns out that the strip_html() function does a strcpy at the end which
may write a single null byte over the null byte of the empty string, and
if it's not in writable memory, that blows up.

Thanks to iamthemcmaster / mcm for pointing this out

File:

• protocols/jabber/conference.c (modified) (1 diff)

protocols/jabber/conference.c

@@ -466 +466 @@
 
         if (subject && chat) {
-                char *subject_text = subject->text_len > 0 ? subject->text : "";
+                char empty[1] = "";
+                char *subject_text = subject->text_len > 0 ? subject->text : empty;
                 if (g_strcmp0(chat->topic, subject_text) != 0) {
                         bare_jid = (bud) ? jabber_get_bare_jid(bud->ext_jid) : NULL;