/pidgin/main: 66611fba7197: Merge the release-2.x.y branch to main.
Mark Doliner
mark at kingant.net
Mon Feb 18 20:25:20 EST 2013
Changeset: 66611fba71971138823498ed51edca8899b1071b
Author: Mark Doliner <mark at kingant.net>
Date: 2013-02-18 17:25 -0800
Branch: default
URL: http://hg.pidgin.im/pidgin/main/rev/66611fba7197
Description:
Merge the release-2.x.y branch to main.
diffstat:
.hgtags | 1 +
COPYRIGHT | 2 +-
ChangeLog | 33 +-
ChangeLog.API | 3 +
Makefile.mingw | 4 +-
configure.ac | 2 +-
libpurple/plugins/tcl/tcl.c | 4 +-
libpurple/protocols/irc/msgs.c | 2 +-
libpurple/protocols/jabber/jabber.c | 4 +-
libpurple/protocols/mxit/cipher.c | 16 +-
libpurple/protocols/mxit/formcmds.c | 14 +-
libpurple/protocols/mxit/http.c | 9 +-
libpurple/protocols/mxit/mxit.c | 7 +-
libpurple/protocols/mxit/protocol.h | 1 +
libpurple/protocols/mxit/splashscreen.c | 4 +-
libpurple/protocols/sametime/sametime.c | 2 +-
libpurple/protocols/yahoo/libymsg.c | 2 +-
libpurple/upnp.c | 14 +-
pidgin/gtkdialogs.c | 16 +-
pidgin/gtklog.c | 2 +-
pidgin/plugins/cap/cap.c | 2 +-
pidgin/plugins/timestamp_format.c | 2 +-
pidgin/win32/nsis/generate_gtk_zip.sh | 2 +-
pidgin/win32/nsis/pidgin-installer.nsi | 11 +-
po/ChangeLog | 26 +-
po/POTFILES.skip | 63 +
po/el.po | 5079 +++++----------
po/et.po | 5059 +++++----------
po/ga.po | 9517 +++++++++++++++--------------
po/he.po | 886 +-
po/hr.po | 10 +-
po/lt.po | 4389 ++++---------
po/my_MM.po | 88 +-
po/nl.po | 557 +-
po/nn.po | 87 +-
po/pa.po | 795 +-
po/pl.po | 552 +-
po/pt.po | 9945 ++++++++++--------------------
po/pt_BR.po | 1807 ++---
39 files changed, 15667 insertions(+), 23352 deletions(-)
diffs (truncated from 71418 to 300 lines):
diff --git a/.hgtags b/.hgtags
--- a/.hgtags
+++ b/.hgtags
@@ -86,3 +86,4 @@ dab0253fe3754ffd68e070cdfbbf31cd79f9a421
1d00b9e4aa6add6dca97cca4ac614d63bd105dfd v2.10.4
a3d157700972b48cf0a23b300261a5ab0c6e165b v2.10.5
4992bd90d8ad78ebdd324dd90d3e9d443f7dd002 v2.10.6
+ad7e7fb98db3bbd7bf9ab49072fd34cd4fa25dd9 v2.10.7
diff --git a/COPYRIGHT b/COPYRIGHT
--- a/COPYRIGHT
+++ b/COPYRIGHT
@@ -15,7 +15,7 @@ If concerns are raised as to the copyrig
piece of code, then that code should be traced through our version
control system to see from where it came and who has modified it.
-Copyright (C) 1998-2012 by the following:
+Copyright (C) 1998-2013 by the following:
Mark
Saleem Abdulrasool
diff --git a/ChangeLog b/ChangeLog
--- a/ChangeLog
+++ b/ChangeLog
@@ -57,10 +57,9 @@ version 3.0.0 (??/??/????):
* The Offline Message Emulation plugin now adds a note that the message
was an offline message. (Flavius Anton) (#2497)
-version 2.10.7:
- Gadu-Gadu:
- * Fix a crash at startup with large contact list. Avatar support for
- buddies will be disabled till 3.0.0. (#15226, #14305)
+version 2.10.7 (02/13/2013):
+ Alien hatchery:
+ * No changes
General:
* The configure script will now exit with status 1 when specifying
@@ -68,6 +67,8 @@ version 2.10.7:
--with-dynamic-prpls arguments. (Michael Fiedler) (#15316)
libpurple:
+ * Fix a crash when receiving UPnP responses with abnormally long values.
+ (CVE-2013-0274)
* Don't link directly to libgcrypt when building with GnuTLS support.
(Bartosz Brachaczek) (#15329)
* Fix UPnP mappings on routers that return empty <URLBase/> elements
@@ -82,10 +83,10 @@ version 2.10.7:
Gadu-Gadu:
* Fix a crash at startup with large contact list. Avatar support for
- buddies will be disabled till 3.0.0. (#15226, #14305)
+ buddies will be disabled until 3.0.0. (#15226, #14305)
IRC:
- * Support for SASL authentication. (Thijs Alkemade, Andy Spencer)
+ * Support for SASL authentication. (Thijs Alkemade, Andy Spencer)
(#13270)
* Print topic setter information at channel join. (#13317)
@@ -95,6 +96,11 @@ version 2.10.7:
Barfield) (#15217)
MXit:
+ * Fix two bugs where a remote MXit user could possibly specify a local
+ file path to be written to. (CVE-2013-0271)
+ * Fix a bug where the MXit server or a man-in-the-middle could
+ potentially send specially crafted data that could overflow a buffer
+ and lead to a crash or remote code execution. (CVE-2013-0272)
* Display farewell messages in a different colour to distinguish
them from normal messages.
* Add support for typing notification.
@@ -105,6 +111,12 @@ version 2.10.7:
* The buddy's name was not centered vertically in the buddy-list if they
did not have a status-message or mood set.
* Fix decoding of font-size changes in the markup of received messages.
+ * Increase the maximum file size that can be transferred to 1 MB.
+ * When setting an avatar image, no longer downscale it to 96x96.
+
+ Sametime:
+ * Fix a crash in Sametime when a malicious server sends us an abnormally
+ long user ID. (CVE-2013-0273)
Yahoo!:
* Fix a double-free in profile/picture loading code. (Mihai Serban)
@@ -120,11 +132,14 @@ version 2.10.7:
such as MacPorts' +no_x11 variant.
Windows-Specific Changes:
- * Compile with secure flags (#15290)
+ * Compile with secure flags (Jurre van Bergen) (#15290)
* Installer downloads GTK+ Runtime and Debug Symbols more securely.
- (#15277)
+ Thanks goes to Jacob Appelbaum of the Tor Project for identifying
+ this issue and suggesting solutions. (#15277)
* Updates to a number of dependencies, some of which have security
- related fixes. (#14571, #15285, #15286)
+ related fixes. Thanks again to Jacob Appelbaum and Jurre van Bergen
+ for identifying the vulnerable libraries and to Dieter Verfaillie
+ for helping getting the libraries updated. (#14571, #15285, #15286)
* ATK 1.32.0-2
* Cyrus SASL 2.1.25
* expat 2.1.0-1
diff --git a/ChangeLog.API b/ChangeLog.API
--- a/ChangeLog.API
+++ b/ChangeLog.API
@@ -267,6 +267,9 @@ version 3.0.0 (??/??/????):
* xmlnode_set_attrib_with_namespace
* xmlnode_set_attrib_with_prefix
+version 2.10.7:
+ * No changes
+
version 2.10.6:
* No changes
diff --git a/Makefile.mingw b/Makefile.mingw
--- a/Makefile.mingw
+++ b/Makefile.mingw
@@ -38,14 +38,14 @@ authenticode_sign = $(MONO_SIGNCODE) \
-a sha1 -$$ commercial \
-n "$(2)" -i "https://pidgin.im" \
-t "http://timestamp.verisign.com/scripts/timstamp.dll" -tr 10 \
- $(1)
+ $(1) && rm -f $(1).bak
gpg_sign = $(GPG_SIGN) -ab $(1) && $(GPG_SIGN) --verify $(1).asc
STRIPPED_RELEASE_DIR = $(PIDGIN_TREE_TOP)/pidgin-$(PIDGIN_VERSION)-win32bin
DEBUG_SYMBOLS_DIR = $(PIDGIN_TREE_TOP)/pidgin-$(PIDGIN_VERSION)-dbgsym
-PIDGIN_INST_DEP_DIR="$(WIN32_DEV_TOP)/pidgin-inst-deps-20120910"
+PIDGIN_INST_DEP_DIR="$(WIN32_DEV_TOP)/pidgin-inst-deps-20130214"
# Any *.dll or *.exe files included in win32-install-dir that we don't compile
# should be included in this list so they don't get stripped
diff --git a/configure.ac b/configure.ac
--- a/configure.ac
+++ b/configure.ac
@@ -55,7 +55,7 @@ m4_define([purple_display_version], purp
m4_define([gnt_lt_current], [8])
m4_define([gnt_major_version], [2])
m4_define([gnt_minor_version], [8])
-m4_define([gnt_micro_version], [9])
+m4_define([gnt_micro_version], [10])
m4_define([gnt_version_suffix], [devel])
m4_define([gnt_version],
[gnt_major_version.gnt_minor_version.gnt_micro_version])
diff --git a/libpurple/plugins/tcl/tcl.c b/libpurple/plugins/tcl/tcl.c
--- a/libpurple/plugins/tcl/tcl.c
+++ b/libpurple/plugins/tcl/tcl.c
@@ -422,8 +422,8 @@ static PurplePluginInfo tcl_info =
};
#ifdef _WIN32
-typedef Tcl_Interp* (CALLBACK* LPFNTCLCREATEINTERP)(void);
-typedef void (CALLBACK* LPFNTKINIT)(Tcl_Interp*);
+typedef Tcl_Interp* (__cdecl* LPFNTCLCREATEINTERP)(void);
+typedef void (__cdecl* LPFNTKINIT)(Tcl_Interp*);
LPFNTCLCREATEINTERP wtcl_CreateInterp = NULL;
LPFNTKINIT wtk_Init = NULL;
diff --git a/libpurple/protocols/irc/msgs.c b/libpurple/protocols/irc/msgs.c
--- a/libpurple/protocols/irc/msgs.c
+++ b/libpurple/protocols/irc/msgs.c
@@ -667,7 +667,7 @@ void irc_msg_topicinfo(struct irc_conn *
timestamp = g_strdup(purple_time_format(tm));
datestamp = g_strdup(purple_date_format_short(tm));
- msg = g_strdup_printf("Topic for %s set by %s at %s on %s", args[1], args[2], timestamp, datestamp);
+ msg = g_strdup_printf(_("Topic for %s set by %s at %s on %s"), args[1], args[2], timestamp, datestamp);
purple_conv_chat_write(PURPLE_CONV_CHAT(convo), "", msg, PURPLE_MESSAGE_SYSTEM | PURPLE_MESSAGE_NO_LINKIFY, time(NULL));
g_free(timestamp);
g_free(datestamp);
diff --git a/libpurple/protocols/jabber/jabber.c b/libpurple/protocols/jabber/jabber.c
--- a/libpurple/protocols/jabber/jabber.c
+++ b/libpurple/protocols/jabber/jabber.c
@@ -667,7 +667,7 @@ jabber_recv_cb_ssl(gpointer data, Purple
else {
gchar *tmp;
if (len == 0)
- tmp = g_strdup_printf(_("Server closed the connection"));
+ tmp = g_strdup(_("Server closed the connection"));
else
tmp = g_strdup_printf(_("Lost connection with server: %s"),
g_strerror(errno));
@@ -725,7 +725,7 @@ jabber_recv_cb(gpointer data, gint sourc
} else {
gchar *tmp;
if (len == 0)
- tmp = g_strdup_printf(_("Server closed the connection"));
+ tmp = g_strdup(_("Server closed the connection"));
else
tmp = g_strdup_printf(_("Lost connection with server: %s"),
g_strerror(errno));
diff --git a/libpurple/protocols/mxit/cipher.c b/libpurple/protocols/mxit/cipher.c
--- a/libpurple/protocols/mxit/cipher.c
+++ b/libpurple/protocols/mxit/cipher.c
@@ -110,14 +110,12 @@ char* mxit_encrypt_password( struct MXit
char key[16 + 1];
char exkey[512];
GString* pass = NULL;
- char encrypted[64];
+ GString* encrypted = NULL;
char* base64;
int i;
purple_debug_info( MXIT_PLUGIN_ID, "mxit_encrypt_password\n" );
- memset( encrypted, 0x00, sizeof( encrypted ) );
-
/* build the AES encryption key */
g_strlcpy( key, INITIAL_KEY, sizeof( key ) );
memcpy( key, session->clientkey, strlen( session->clientkey ) );
@@ -129,11 +127,17 @@ char* mxit_encrypt_password( struct MXit
padding_add( pass ); /* add ISO10126 padding */
/* now encrypt the secret. we encrypt each block separately (ECB mode) */
- for ( i = 0; i < pass->len; i += 16 )
- Encrypt( (unsigned char*) pass->str + i, (unsigned char*) exkey, (unsigned char*) encrypted + i );
+ encrypted = g_string_sized_new( pass->len );
+ for ( i = 0; i < pass->len; i += 16 ) {
+ char block[16];
+
+ Encrypt( (unsigned char*) pass->str + i, (unsigned char*) exkey, (unsigned char*) block );
+ g_string_append_len( encrypted, block, 16 );
+ }
/* now base64 encode the encrypted password */
- base64 = purple_base64_encode( (unsigned char*) encrypted, pass->len );
+ base64 = purple_base64_encode( (unsigned char*) encrypted->str, encrypted->len );
+ g_string_free( encrypted, TRUE );
g_string_free( pass, TRUE );
diff --git a/libpurple/protocols/mxit/formcmds.c b/libpurple/protocols/mxit/formcmds.c
--- a/libpurple/protocols/mxit/formcmds.c
+++ b/libpurple/protocols/mxit/formcmds.c
@@ -406,19 +406,29 @@ static void command_imagestrip(struct MX
guchar* rawimg;
gsize rawimglen;
char* dir;
+ char* escfrom;
+ char* escname;
+ char* escvalidator;
char* filename;
/* base64 decode the image data */
rawimg = purple_base64_decode(tmp, &rawimglen);
/* save it to a file */
- dir = g_strdup_printf("%s/mxit/imagestrips", purple_user_dir());
+ dir = g_build_filename(purple_user_dir(), "mxit", "imagestrips", NULL);
purple_build_dir(dir, S_IRUSR | S_IWUSR | S_IXUSR); /* ensure directory exists */
- filename = g_strdup_printf("%s/%s-%s-%s.png", dir, from, name, validator);
+ escfrom = g_strdup(purple_escape_filename(from));
+ escname = g_strdup(purple_escape_filename(name));
+ escvalidator = g_strdup(purple_escape_filename(validator));
+ filename = g_strdup_printf("%s" G_DIR_SEPARATOR_S "%s-%s-%s.png", dir, escfrom, escname, escvalidator);
+
purple_util_write_data_to_file_absolute(filename, (char*) rawimg, rawimglen);
g_free(dir);
+ g_free(escfrom);
+ g_free(escname);
+ g_free(escvalidator);
g_free(filename);
}
diff --git a/libpurple/protocols/mxit/http.c b/libpurple/protocols/mxit/http.c
--- a/libpurple/protocols/mxit/http.c
+++ b/libpurple/protocols/mxit/http.c
@@ -116,11 +116,12 @@ static void mxit_cb_http_read( gpointer
buflen = session->rx_i;
/* read bytes from the socket */
- len = read( session->fd, buf + buflen, sizeof( buf ) - buflen );
+ len = read( session->fd, buf + buflen, sizeof( buf ) - ( buflen + 1 ) );
if ( len <= 0 ) {
/* connection has been terminated, or error occurred */
goto done;
}
+ buf[buflen+len] = '\0';
//nextpacket:
@@ -181,7 +182,11 @@ static void mxit_cb_http_read( gpointer
g_free( tmp );
tmp = NULL;
- if ( buflen > ( ( body - buf ) + bodylen ) ) {
+ if ( buflen + bodylen >= CP_MAX_PACKET ) {
+ /* this packet is way to big */
+ goto done;
+ }
+ else if ( buflen > ( ( body - buf ) + bodylen ) ) {
/* we have a second packet here */
next = body + bodylen;
session->rx_res = 0;
diff --git a/libpurple/protocols/mxit/mxit.c b/libpurple/protocols/mxit/mxit.c
More information about the Commits
mailing list