Changeset c1a3c27

Timestamp:

2010-03-17T23:41:07Z (15 years ago)

Author:

Wilmer van der Gaast <wilmer@…>

Branches:

master

Children:

42fc5b6

Parents:

60e4df3

Message:

Avoid some NULL pointer dereferences on malformed XMPP packets.

File:

• protocols/jabber/iq.c (modified) (7 diffs)

protocols/jabber/iq.c

@@ -658 +658 @@
         struct xt_node *c;
         struct jabber_buddy *bud;
-        char *feature;
+        char *feature, *xmlns, *from;
 
         if( !( c = xt_find_node( node->children, "query" ) ) ||
-            !( strcmp( xt_find_attr( c, "xmlns" ), XMLNS_DISCO_INFO ) == 0 ) )
+            !( from = xt_find_attr( c, "from" ) ) ||
+            !( xmlns = xt_find_attr( c, "xmlns" ) ) ||
+            !( strcmp( xmlns, XMLNS_DISCO_INFO ) == 0 ) )
         {
                 imcb_log( ic, "WARNING: Received incomplete IQ-result packet for discover" );
                 return XT_HANDLED;
         }
-        if( ( bud = jabber_buddy_by_jid( ic, xt_find_attr( node, "from") , 0 ) ) == NULL )
+        if( ( bud = jabber_buddy_by_jid( ic, from, 0 ) ) == NULL )
         {
                 /* Who cares about the unknown... */
-                imcb_log( ic, "Couldn't find buddy: %s", xt_find_attr( node, "from"));
+                imcb_log( ic, "Couldn't find buddy: %s", from );
                 return 0;
         }
@@ -677 +679 @@
         {
                 feature = xt_find_attr( c, "var" );
-                bud->features = g_slist_append( bud->features, g_strdup( feature ) );
+                if( feature )
+                        bud->features = g_slist_append( bud->features, g_strdup( feature ) );
                 c = c->next;
         }
@@ -713 +716 @@
         struct xt_node *c;
         struct jabber_data *jd = ic->proto_data;
+        char *xmlns, *from;
 
         if( !( c = xt_find_node( node->children, "query" ) ) ||
-            !xt_find_attr( node, "from" ) )
+            !( from = xt_find_attr( node, "from" ) ) ||
+            !( xmlns = xt_find_attr( c, "xmlns" ) ) )
         {
                 imcb_log( ic, "WARNING: Received incomplete IQ-result packet for discover" );
@@ -723 +728 @@
         jd->have_streamhosts++;
 
-        if( strcmp( xt_find_attr( c, "xmlns" ), XMLNS_DISCO_ITEMS ) == 0 )
-        {
-                char *item, *itemjid;
+        if( strcmp( xmlns, XMLNS_DISCO_ITEMS ) == 0 )
+        {
+                char *itemjid;
 
                 /* answer from server */
@@ -732 +737 @@
                 while( ( c = xt_find_node( c, "item" ) ) )
                 {
-                        item = xt_find_attr( c, "name" );
                         itemjid = xt_find_attr( c, "jid" );
-
-                        jabber_iq_query_server( ic, itemjid, XMLNS_DISCO_INFO );
+                        
+                        if( itemjid )
+                                jabber_iq_query_server( ic, itemjid, XMLNS_DISCO_INFO );
 
                         c = c->next;
                 }
         }
-        else if( strcmp( xt_find_attr( c, "xmlns" ), XMLNS_DISCO_INFO ) == 0 )
+        else if( xmlns, XMLNS_DISCO_INFO ) == 0 )
         {
                 char *category, *type;
@@ -754 +759 @@
                         if( type && ( strcmp( type, "bytestreams" ) == 0 ) &&
                             category && ( strcmp( category, "proxy" ) == 0 ) )
-                                jabber_iq_query_server( ic, xt_find_attr( node, "from" ), XMLNS_BYTESTREAMS );
+                                jabber_iq_query_server( ic, from, XMLNS_BYTESTREAMS );
 
                         c = c->next;
                 }
         }
-        else if( strcmp( xt_find_attr( c, "xmlns" ), XMLNS_BYTESTREAMS ) == 0 )
-        {
-                char *host, *jid;
+        else if( xmlns, XMLNS_BYTESTREAMS ) == 0 )
+        {
+                char *host, *jid, *port_s;
                 int port;
 
@@ -768 +773 @@
                 if( ( c = xt_find_node( c->children, "streamhost" ) ) &&
                     ( host = xt_find_attr( c, "host" ) ) &&
-                    ( port = atoi( xt_find_attr( c, "port" ) ) ) &&
+                    ( port_s = xt_find_attr( c, "port" ) ) &&
+                    ( sscanf( port_s, "%d", &port ) == 1 ) &&
                     ( jid = xt_find_attr( c, "jid" ) ) )
                 {
                         jabber_streamhost_t *sh = g_new0( jabber_streamhost_t, 1 );
+                        
                         sh->jid = g_strdup( jid );
                         sh->host = g_strdup( host );
-                        sprintf( sh->port, "%u", port );
+                        g_snprintf( sh->port, sizeof( sh->port ), "%u", port );
 
                         imcb_log( ic, "Proxy found: jid %s host %s port %u", jid, host, port );