commit 0b0db176e378c01771b25ab571a7c3f3bf19ecde
parent 857abfa7c035d930dfda746fdbb3e546e0eba202
Author: Colin Leroy <colin@colino.net>
Date: Mon, 4 May 2009 16:46:52 +0000
2009-05-04 [colin] 3.7.1cvs49
* src/msgcache.c
Probably fix bug 1914, 'Crash reading
corrupted tags file'
Diffstat:
4 files changed, 28 insertions(+), 7 deletions(-)
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,9 @@
+2009-05-04 [colin] 3.7.1cvs49
+
+ * src/msgcache.c
+ Probably fix bug 1914, 'Crash reading
+ corrupted tags file'
+
2009-04-26 [paul] 3.7.1cvs48
* configure.ac
diff --git a/PATCHSETS b/PATCHSETS
@@ -3788,3 +3788,4 @@
( cvs diff -u -r 1.1.2.24 -r 1.1.2.25 src/printing.c; cvs diff -u -r 1.43.2.108 -r 1.43.2.109 src/toolbar.c; ) > 3.7.1cvs46.patchset
( cvs diff -u -r 1.1.2.25 -r 1.1.2.26 src/printing.c; ) > 3.7.1cvs47.patchset
( cvs diff -u -r 1.654.2.3855 -r 1.654.2.3856 configure.ac; cvs diff -u -r 1.5.2.17 -r 1.5.2.18 src/gtk/gtkaspell.h; ) > 3.7.1cvs48.patchset
+( cvs diff -u -r 1.16.2.67 -r 1.16.2.68 src/msgcache.c; ) > 3.7.1cvs49.patchset
diff --git a/configure.ac b/configure.ac
@@ -12,7 +12,7 @@ MINOR_VERSION=7
MICRO_VERSION=1
INTERFACE_AGE=0
BINARY_AGE=0
-EXTRA_VERSION=48
+EXTRA_VERSION=49
EXTRA_RELEASE=
EXTRA_GTK2_VERSION=
diff --git a/src/msgcache.c b/src/msgcache.c
@@ -319,15 +319,25 @@ gint msgcache_get_memory_usage(MsgCache *cache)
n = swapping ? bswap_32(idata) : (idata);\
}
-#define GET_CACHE_DATA_INT(n) \
-{ \
- n = (swapping ? (MMAP_TO_GUINT32_SWAPPED(walk_data)):(MMAP_TO_GUINT32(walk_data))); \
- walk_data += 4; rem_len -= 4; \
+#define GET_CACHE_DATA_INT(n) \
+{ \
+ if (rem_len < 4) { \
+ g_print("error at rem_len:%d\n", rem_len); \
+ error = TRUE; \
+ goto bail_err; \
+ } \
+ n = (swapping ? (MMAP_TO_GUINT32_SWAPPED(walk_data)):(MMAP_TO_GUINT32(walk_data))); \
+ walk_data += 4; rem_len -= 4; \
}
#define GET_CACHE_DATA(data, total_len) \
{ \
GET_CACHE_DATA_INT(tmp_len); \
+ if (rem_len < tmp_len) { \
+ g_print("error at rem_len:%d (tmp_len %d)\n", rem_len, tmp_len); \
+ error = TRUE; \
+ goto bail_err; \
+ } \
if ((tmp_len = msgcache_get_cache_data_str(walk_data, &data, tmp_len, conv)) < 0) { \
g_print("error at rem_len:%d\n", rem_len);\
procmsg_msginfo_free(msginfo); \
@@ -793,7 +803,8 @@ void msgcache_read_mark(MsgCache *cache, const gchar *mark_file)
gint map_len = -1;
char *cache_data = NULL;
struct stat st;
-
+ gboolean error;
+
swapping = TRUE;
/* In case we can't open the mark file with MARK_VERSION, check if we can open it with the
@@ -866,6 +877,7 @@ void msgcache_read_mark(MsgCache *cache, const gchar *mark_file)
}
}
}
+bail_err:
fclose(fp);
}
@@ -877,7 +889,8 @@ void msgcache_read_tags(MsgCache *cache, const gchar *tags_file)
gint map_len = -1;
char *cache_data = NULL;
struct stat st;
-
+ gboolean error = FALSE;
+
swapping = TRUE;
/* In case we can't open the mark file with MARK_VERSION, check if we can open it with the
@@ -971,6 +984,7 @@ void msgcache_read_tags(MsgCache *cache, const gchar *tags_file)
}
}
}
+bail_err:
fclose(fp);
}
