/pidgin/main: 5ae57760ca10: Merged TALOS-CAN-0137

[Gary Kramlich]

Changeset: 5ae57760ca102ad93136e8ca1235d95e5fc537c0
Author:	 Gary Kramlich <grim at reaperworld.com>
Date:	 2016-06-12 22:17 -0500
Branch:	 release-2.x.y
URL: https://hg.pidgin.im/pidgin/main/rev/5ae57760ca10

Description:

Merged TALOS-CAN-0137

diffstat:

 ChangeLog                           |  2 ++
 libpurple/protocols/mxit/protocol.c |  3 ++-
 2 files changed, 4 insertions(+), 1 deletions(-)

diffs (25 lines):

diff --git a/ChangeLog b/ChangeLog
--- a/ChangeLog
+++ b/ChangeLog
@@ -35,6 +35,8 @@ version 2.10.13 (MM/DD/YY):
 	  read.  Discovered by Yves Younan of Cisco Talos (TALOS-CAN-0134)
 	* Fixed multiple remote buffer overflows.  Discovered by Yves Younan of
 	  Cisco Talos.  (TALOS-CAN-0136)
+	* Fixed a remote NULL pointer dereference.  Discovered by Yves Younan of
+	  Cisco Talos (TALOS-CAN-0137)
 
 version 2.10.12 (12/31/15):
 	General:
diff --git a/libpurple/protocols/mxit/protocol.c b/libpurple/protocols/mxit/protocol.c
--- a/libpurple/protocols/mxit/protocol.c
+++ b/libpurple/protocols/mxit/protocol.c
@@ -2662,7 +2662,8 @@ int mxit_parse_packet( struct MXitSessio
 						/* new record */
 						if ( packet.rcount == 1 ) {
 							/* packet command */
-							packet.cmd = atoi( packet.records[0]->fields[0]->data );
+							if ( packet.records[0]->fcount > 0 )
+								packet.cmd = atoi( packet.records[0]->fields[0]->data );
 						}
 						else if ( packet.rcount == 2 ) {
 							/* special case: binary multimedia packets should not be parsed here */