/pidgin/main: abdc3025f6b8: Fix TALOS-CAN-0134

[Andrew Victor]

Changeset: abdc3025f6b8b0dabb36bc84e994d6735e4abb3c
Author:	 Andrew Victor <andrew.victor at mxit.com>
Date:	 2016-06-02 13:24 -0500
Branch:	 release-2.x.y
URL: https://hg.pidgin.im/pidgin/main/rev/abdc3025f6b8

Description:

Fix TALOS-CAN-0134

diffstat:

 libpurple/protocols/mxit/formcmds.c |  12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diffs (37 lines):

diff --git a/libpurple/protocols/mxit/formcmds.c b/libpurple/protocols/mxit/formcmds.c
--- a/libpurple/protocols/mxit/formcmds.c
+++ b/libpurple/protocols/mxit/formcmds.c
@@ -519,9 +519,9 @@ static void command_table(struct RXMsgDa
 	const char* tmp;
 	const char* name;
 	int mode;
-	int nr_columns = 0, nr_rows = 0;
+	unsigned int nr_columns = 0, nr_rows = 0;
 	gchar** coldata;
-	int i, j;
+	unsigned int i, j;
 
 	/* table name */
 	name = g_hash_table_lookup(hash, "nm");
@@ -542,6 +542,12 @@ static void command_table(struct RXMsgDa
 	tmp = g_hash_table_lookup(hash, "d");
 	coldata = g_strsplit(tmp, "~", 0);			/* split into entries for each row & column */
 
+	if (g_strv_length(coldata) != (nr_rows * nr_columns)) {
+		purple_debug_info(MXIT_PLUGIN_ID, "Invalid table data: cols=%i rows=%i\n", nr_columns, nr_rows);
+		g_strfreev(coldata);
+		return;
+	}
+
 	purple_debug_info(MXIT_PLUGIN_ID, "Table %s from %s: [cols=%i rows=%i mode=%i]\n", name, mx->from, nr_columns, nr_rows, mode);
 
 	for (i = 0; i < nr_rows; i++) {
@@ -549,6 +555,8 @@ static void command_table(struct RXMsgDa
 			purple_debug_info(MXIT_PLUGIN_ID, " Row %i Column %i = %s\n", i, j, coldata[i*nr_columns + j]);
 		}
 	}
+
+	g_strfreev(coldata);
 }