pidgin: 9c6cdf62: Patch written by Mark Doliner and Paul A...

[rekkanoryo at pidgin.im]

-----------------------------------------------------------------
Revision: 9c6cdf62a91e5a4112bc362ea0d2e741b9baf7e8
Ancestor: da72c2930b742de61d1acf73b9b75d7d91d3cbdf
Author: rekkanoryo at pidgin.im
Date: 2009-08-16T23:27:24
Branch: im.pidgin.pidgin
URL: http://d.pidgin.im/viewmtn/revision/info/9c6cdf62a91e5a4112bc362ea0d2e741b9baf7e8

Modified files:
        libpurple/protocols/msn/slplink.c

ChangeLog: 

Patch written by Mark Doliner and Paul Aurich to fix a remote crash on MSN
reported to us by the CORE Security Technologies Security Advisories Team.

-------------- next part --------------
============================================================
--- libpurple/protocols/msn/slplink.c	04fd3b72538b01c4ec83fa596a37340af5f19d3c
+++ libpurple/protocols/msn/slplink.c	bcb3eb4224e4e0b61b948f6a6ce767395058fa7f
@@ -441,6 +441,7 @@ msn_slplink_send_ack(MsnSlpLink *slplink
 	slpmsg->info = "SLP ACK";
 
 	msn_slplink_send_slpmsg(slplink, slpmsg);
+	msn_slpmsg_destroy(slpmsg);
 }
 
 static void
@@ -578,7 +579,7 @@ msn_slplink_process_msg(MsnSlpLink *slpl
 		/* fseek(slpmsg->fp, offset, SEEK_SET); */
 		len = fwrite(data, 1, len, slpmsg->fp);
 	}
-	else if (slpmsg->size)
+	else if (slpmsg->size && slpmsg->buffer)
 	{
 		if (G_MAXSIZE - len < offset || (offset + len) > slpmsg->size)
 		{