Remotely triggerable crash

Mark Doliner mark at kingant.net
Thu Jan 16 02:20:20 EST 2014


I figured this one out. localtime(negative number) returns NULL on
Windows, and we were trying to dereference it. Easy fix is to not do
funky dereferencing thing and just keep track of the pointer value.

Harder fix will be to see if purple_str_to_time() can gracefully
handle overflowing time_t... this is less important, but is still good
for correctness-sake.


More information about the security mailing list