/pidgin/main: 43aa3fab2883: Merged TALOS-CAN-0143

[Gary Kramlich]

Changeset: 43aa3fab28836d2719a4ca90559a8c2085d1a76b
Author:	 Gary Kramlich <grim at reaperworld.com>
Date:	 2016-06-12 22:29 -0500
Branch:	 release-2.x.y
URL: https://hg.pidgin.im/pidgin/main/rev/43aa3fab2883

Description:

Merged TALOS-CAN-0143

diffstat:

 ChangeLog                           |   2 ++
 libpurple/protocols/mxit/protocol.c |  19 +++++++++++++++++++
 2 files changed, 21 insertions(+), 0 deletions(-)

diffs (53 lines):

diff --git a/ChangeLog b/ChangeLog
--- a/ChangeLog
+++ b/ChangeLog
@@ -43,6 +43,8 @@ version 2.10.13 (MM/DD/YY):
 	  handling.  Discovered by Yves Younan of Cisco Talos (TALOS-CAN-0141)
 	* Fixed a remote out-of-bounds write vulnerability.  Discovered by Yves
 	  Younan of Cisco Talos. (TALOS-CAN-0139)
+	* Fix a remote out-of-bounds read.  Discovered by Yves Younan of Cisco
+	  Talos.  (TALOS-CAN-0143)
 
 version 2.10.12 (12/31/15):
 	General:
diff --git a/libpurple/protocols/mxit/protocol.c b/libpurple/protocols/mxit/protocol.c
--- a/libpurple/protocols/mxit/protocol.c
+++ b/libpurple/protocols/mxit/protocol.c
@@ -2020,6 +2020,12 @@ static void mxit_parse_cmd_suggestcontac
 	 * userid \1 contactType \1 value0 \1 value1 ... valueN
 	 */
 
+	/* ensure that record[0] contacts the minumum number of fields */
+	if ( records[0]->fcount < 4 ) {
+		purple_debug_error( MXIT_PLUGIN_ID, "Insufficient number of fields in suggest contacts response. fields=%i", records[0]->fcount );
+		return;
+	}
+
 	/* the type of results */
 	searchType = atoi( records[0]->fields[0]->data );
 
@@ -2029,11 +2035,24 @@ static void mxit_parse_cmd_suggestcontac
 	/* set the count for attributes */
 	count = atoi( records[0]->fields[3]->data );
 
+	/* ensure that record[0] contains the specified number of attributes */
+	if ( records[0]->fcount < ( 4 + count ) ) {
+		purple_debug_error( MXIT_PLUGIN_ID, "Insufficient number of fields in suggest contacts response. fields=%i attributes=%i", records[0]->fcount, count );
+		return;
+	}
+
 	for ( i = 1; i < rcount; i ++ ) {
 		struct record*		rec		= records[i];
 		struct MXitProfile*	profile	= g_new0( struct MXitProfile, 1 );
 		int j;
 
+		/* ensure that each result contains the specified number of attributes */
+		if ( rec->fcount != ( 2 + count ) ) {
+			purple_debug_error( MXIT_PLUGIN_ID, "Insufficient number of fields in suggest contacts response. fields=%i attributes=%i", rec->fcount, count );
+			g_free( profile );
+			continue;
+		}
+
 		g_strlcpy( profile->userid, rec->fields[0]->data, sizeof( profile->userid ) );
 		// TODO: ContactType - User or Service