pidgin.2.x.y: fb216fc8: Fix crashes and memory leaks when receiv...
markdoliner at pidgin.im
markdoliner at pidgin.im
Sat Dec 10 15:01:25 EST 2011
----------------------------------------------------------------------
Revision: fb216fc88b085afc06d9a15209519cde1f4df6c6
Parent: fb1db68d12fdd99cfd7a899c1f62ef39a4fd85e3
Author: markdoliner at pidgin.im
Date: 12/06/11 02:06:01
Branch: im.pidgin.pidgin.2.x.y
URL: http://d.pidgin.im/viewmtn/revision/info/fb216fc88b085afc06d9a15209519cde1f4df6c6
Changelog:
Fix crashes and memory leaks when receiving malformed voice
and video requests. Thanks to Thijs Alkemade for reporting this!
Changes against parent fb1db68d12fdd99cfd7a899c1f62ef39a4fd85e3
patched ChangeLog
patched libpurple/protocols/jabber/jingle/jingle.c
patched libpurple/protocols/jabber/jingle/rtp.c
patched libpurple/protocols/jabber/jingle/session.c
-------------- next part --------------
============================================================
--- ChangeLog 23157de9917d76da33913b7098ceab90b923c052
+++ ChangeLog f010c531682e85aea8f82afd01d5af4be4cea171
@@ -18,6 +18,10 @@ version 2.10.1 (12/05/2011):
* Fix a leak when admitting UTF-8 text with a non-UTF-8 primary
encoding. (#14700)
+ Jabber:
+ * Fix crashes and memory leaks when receiving malformed voice
+ and video requests. Thanks to Thijs Alkemade for reporting this!
+
Sametime:
* Separate "username" and "server" when adding new Sametime accounts.
(#14608)
============================================================
--- libpurple/protocols/jabber/jingle/jingle.c 185980c698f1c26bad6f0f8a23e866c0645ea1d9
+++ libpurple/protocols/jabber/jingle/jingle.c 2933cb6d81371155c69a5a4f97b6b3bf09aa5aa5
@@ -126,7 +126,7 @@ jingle_handle_content_modify(JingleSessi
if (local_content != NULL) {
const gchar *senders = xmlnode_get_attrib(content, "senders");
gchar *local_senders = jingle_content_get_senders(local_content);
- if (strcmp(senders, local_senders))
+ if (!purple_strequal(senders, local_senders))
jingle_content_modify(local_content, senders);
g_free(local_senders);
} else {
============================================================
--- libpurple/protocols/jabber/jingle/session.c 00e7dd7888866a805129a8f17a545159c7e6e378
+++ libpurple/protocols/jabber/jingle/session.c 6f394c4ccad3d4ef658116e13e9db59d4b4a46fb
@@ -288,7 +288,7 @@ jingle_session_create(JabberStream *js,
if (!js->sessions) {
purple_debug_info("jingle",
"Creating hash table for sessions\n");
- js->sessions = g_hash_table_new(g_str_hash, g_str_equal);
+ js->sessions = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, NULL);
}
purple_debug_info("jingle",
"inserting session with key: %s into table\n", sid);
@@ -411,27 +411,25 @@ jingle_add_jingle_packet(JingleSession *
xmlnode_new("jingle");
gchar *local_jid = jingle_session_get_local_jid(session);
gchar *remote_jid = jingle_session_get_remote_jid(session);
+ gchar *sid = jingle_session_get_sid(session);
xmlnode_set_namespace(jingle, JINGLE);
xmlnode_set_attrib(jingle, "action", jingle_get_action_name(action));
if (jingle_session_is_initiator(session)) {
- xmlnode_set_attrib(jingle, "initiator",
- jingle_session_get_local_jid(session));
- xmlnode_set_attrib(jingle, "responder",
- jingle_session_get_remote_jid(session));
+ xmlnode_set_attrib(jingle, "initiator", local_jid);
+ xmlnode_set_attrib(jingle, "responder", remote_jid);
} else {
- xmlnode_set_attrib(jingle, "initiator",
- jingle_session_get_remote_jid(session));
- xmlnode_set_attrib(jingle, "responder",
- jingle_session_get_local_jid(session));
+ xmlnode_set_attrib(jingle, "initiator", remote_jid);
+ xmlnode_set_attrib(jingle, "responder", local_jid);
}
+ xmlnode_set_attrib(jingle, "sid", sid);
+
g_free(local_jid);
g_free(remote_jid);
+ g_free(sid);
- xmlnode_set_attrib(jingle, "sid", jingle_session_get_sid(session));
-
return jingle;
}
@@ -508,11 +506,16 @@ jingle_session_find_content(JingleSessio
JingleContent *
jingle_session_find_content(JingleSession *session, const gchar *name, const gchar *creator)
{
- GList *iter = session->priv->contents;
+ GList *iter;
+
+ if (name == NULL)
+ return NULL;
+
+ iter = session->priv->contents;
for (; iter; iter = g_list_next(iter)) {
JingleContent *content = iter->data;
gchar *cname = jingle_content_get_name(content);
- gboolean result = !strcmp(name, cname);
+ gboolean result = g_str_equal(name, cname);
g_free(cname);
if (creator != NULL) {
@@ -530,11 +533,16 @@ jingle_session_find_pending_content(Jing
JingleContent *
jingle_session_find_pending_content(JingleSession *session, const gchar *name, const gchar *creator)
{
- GList *iter = session->priv->pending_contents;
+ GList *iter;
+
+ if (name == NULL)
+ return NULL;
+
+ iter = session->priv->pending_contents;
for (; iter; iter = g_list_next(iter)) {
JingleContent *content = iter->data;
gchar *cname = jingle_content_get_name(content);
- gboolean result = !strcmp(name, cname);
+ gboolean result = g_str_equal(name, cname);
g_free(cname);
if (creator != NULL) {
============================================================
--- libpurple/protocols/jabber/jingle/rtp.c 2656346b8bf03a7995ef995e7c2e154facdf905e
+++ libpurple/protocols/jabber/jingle/rtp.c dcacf06a52d80015f7bc1676b1ccbdb182276784
@@ -590,6 +590,16 @@ jingle_rtp_init_media(JingleContent *con
senders = jingle_content_get_senders(content);
transport = jingle_content_get_transport(content);
+ if (media_type == NULL) {
+ g_free(name);
+ g_free(remote_jid);
+ g_free(senders);
+ g_free(params);
+ g_object_unref(transport);
+ g_object_unref(session);
+ return FALSE;
+ }
+
if (JINGLE_IS_RAWUDP(transport))
transmitter = "rawudp";
else if (JINGLE_IS_ICEUDP(transport))
@@ -598,17 +608,17 @@ jingle_rtp_init_media(JingleContent *con
transmitter = "notransmitter";
g_object_unref(transport);
- is_audio = !strcmp(media_type, "audio");
+ is_audio = g_str_equal(media_type, "audio");
- if (!strcmp(senders, "both"))
- type = is_audio == TRUE ? PURPLE_MEDIA_AUDIO
+ if (purple_strequal(senders, "both"))
+ type = is_audio ? PURPLE_MEDIA_AUDIO
: PURPLE_MEDIA_VIDEO;
- else if ((strcmp(senders, "initiator") == 0) ==
+ else if (purple_strequal(senders, "initiator") ==
jingle_session_is_initiator(session))
- type = is_audio == TRUE ? PURPLE_MEDIA_SEND_AUDIO
+ type = is_audio ? PURPLE_MEDIA_SEND_AUDIO
: PURPLE_MEDIA_SEND_VIDEO;
else
- type = is_audio == TRUE ? PURPLE_MEDIA_RECV_AUDIO
+ type = is_audio ? PURPLE_MEDIA_RECV_AUDIO
: PURPLE_MEDIA_RECV_VIDEO;
params =
@@ -616,7 +626,17 @@ jingle_rtp_init_media(JingleContent *con
NULL, NULL, &num_params);
creator = jingle_content_get_creator(content);
- if (!strcmp(creator, "initiator"))
+ if (creator == NULL) {
+ g_free(name);
+ g_free(media_type);
+ g_free(remote_jid);
+ g_free(senders);
+ g_free(params);
+ g_object_unref(session);
+ return FALSE;
+ }
+
+ if (g_str_equal(creator, "initiator"))
is_creator = jingle_session_is_initiator(session);
else
is_creator = !jingle_session_is_initiator(session);
@@ -625,6 +645,8 @@ jingle_rtp_init_media(JingleContent *con
if(!purple_media_add_stream(media, name, remote_jid,
type, is_creator, transmitter, num_params, params)) {
purple_media_end(media, NULL, NULL);
+ /* TODO: How much clean-up is necessary here? (does calling
+ purple_media_end lead to cleaning up Jingle structs?) */
return FALSE;
}
@@ -646,10 +668,23 @@ jingle_rtp_parse_codecs(xmlnode *descrip
const char *encoding_name,*id, *clock_rate;
PurpleMediaCodec *codec;
const gchar *media = xmlnode_get_attrib(description, "media");
- PurpleMediaSessionType type =
- !strcmp(media, "video") ? PURPLE_MEDIA_VIDEO :
- !strcmp(media, "audio") ? PURPLE_MEDIA_AUDIO : 0;
+ PurpleMediaSessionType type;
+ if (media == NULL) {
+ purple_debug_warning("jingle-rtp", "missing media type\n");
+ return NULL;
+ }
+
+ if (g_str_equal(media, "video")) {
+ type = PURPLE_MEDIA_VIDEO;
+ } else if (g_str_equal(media, "audio")) {
+ type = PURPLE_MEDIA_AUDIO;
+ } else {
+ purple_debug_warning("jingle-rtp", "unknown media type: %s\n",
+ media);
+ return NULL;
+ }
+
for (codec_element = xmlnode_get_child(description, "payload-type") ;
codec_element ;
codec_element = xmlnode_get_next_twin(codec_element)) {
@@ -769,19 +804,19 @@ jingle_rtp_handle_action_internal(Jingle
switch (action) {
case JINGLE_SESSION_ACCEPT:
case JINGLE_SESSION_INITIATE: {
- JingleSession *session = jingle_content_get_session(content);
- JingleTransport *transport = jingle_transport_parse(
- xmlnode_get_child(xmlcontent, "transport"));
- xmlnode *description = xmlnode_get_child(xmlcontent, "description");
- GList *candidates = jingle_rtp_transport_to_candidates(transport);
- GList *codecs = jingle_rtp_parse_codecs(description);
- gchar *name = jingle_content_get_name(content);
- gchar *remote_jid =
- jingle_session_get_remote_jid(session);
+ JingleSession *session;
+ JingleTransport *transport;
+ xmlnode *description;
+ GList *candidates;
+ GList *codecs;
+ gchar *name;
+ gchar *remote_jid;
PurpleMedia *media;
+ session = jingle_content_get_session(content);
+
if (action == JINGLE_SESSION_INITIATE &&
- jingle_rtp_init_media(content) == FALSE) {
+ !jingle_rtp_init_media(content)) {
/* XXX: send error */
jabber_iq_send(jingle_session_terminate_packet(
session, "general-error"));
@@ -789,6 +824,14 @@ jingle_rtp_handle_action_internal(Jingle
break;
}
+ transport = jingle_transport_parse(
+ xmlnode_get_child(xmlcontent, "transport"));
+ description = xmlnode_get_child(xmlcontent, "description");
+ candidates = jingle_rtp_transport_to_candidates(transport);
+ codecs = jingle_rtp_parse_codecs(description);
+ name = jingle_content_get_name(content);
+ remote_jid = jingle_session_get_remote_jid(session);
+
media = jingle_rtp_get_media(session);
purple_media_set_remote_codecs(media,
name, remote_jid, codecs);
More information about the Commits
mailing list