From 7de513f180c429859e246d1033d745b394e1fc28 Mon Sep 17 00:00:00 2001
From: George Hazan <george.hazan@gmail.com>
Date: Thu, 4 Jun 2015 21:30:30 +0000
Subject: fix for a buffer overrun in GTalk

git-svn-id: http://svn.miranda-ng.org/main/trunk@14001 1316c22d-e87f-b044-9b9b-93d7a3e3ba9c
---
 protocols/GTalkExt/src/avatar.cpp        | 11 +++----
 protocols/GTalkExt/src/notifications.cpp | 55 ++++++++++++++++----------------
 2 files changed, 32 insertions(+), 34 deletions(-)

(limited to 'protocols')

diff --git a/protocols/GTalkExt/src/avatar.cpp b/protocols/GTalkExt/src/avatar.cpp
index 8af3953e98..47d760cf70 100644
--- a/protocols/GTalkExt/src/avatar.cpp
+++ b/protocols/GTalkExt/src/avatar.cpp
@@ -127,13 +127,12 @@ BOOL InitAvaUnit(BOOL init)
 		hAvaChanged = HookEvent(ME_AV_AVATARCHANGED, AvaChanged);
 		return hAvaChanged != 0;
 	}
-	else {
-		if (hAvaChanged) {
-			UnhookEvent(hAvaChanged);
-			hAvaChanged = 0;
-		}
-		return TRUE;
+
+	if (hAvaChanged) {
+		UnhookEvent(hAvaChanged);
+		hAvaChanged = 0;
 	}
+	return TRUE;
 }
 
 void SetAvatar(MCONTACT hContact)
diff --git a/protocols/GTalkExt/src/notifications.cpp b/protocols/GTalkExt/src/notifications.cpp
index fa83bcb284..9e3bd386e1 100644
--- a/protocols/GTalkExt/src/notifications.cpp
+++ b/protocols/GTalkExt/src/notifications.cpp
@@ -67,9 +67,9 @@ void MarkEventRead(MCONTACT hCnt, MEVENT hEvt)
 {
 	DWORD settings = (DWORD)TlsGetValue(itlsSettings);
 	if (ReadCheckbox(0, IDC_POPUPSENABLED, settings) &&
-		 ReadCheckbox(0, IDC_PSEUDOCONTACTENABLED, settings) &&
-		 ReadCheckbox(0, IDC_MARKEVENTREAD, settings) &&
-		 db_event_markRead(hCnt, hEvt) != -1)
+		ReadCheckbox(0, IDC_PSEUDOCONTACTENABLED, settings) &&
+		ReadCheckbox(0, IDC_MARKEVENTREAD, settings) &&
+		db_event_markRead(hCnt, hEvt) != -1)
 		CallService(MS_CLIST_REMOVEEVENT, hCnt, hEvt);
 }
 
@@ -107,20 +107,20 @@ LRESULT CALLBACK PopupProc(HWND wnd, UINT msg, WPARAM wParam, LPARAM lParam)
 		return 0;
 
 	case UM_FREEPLUGINDATA:
-	{
-		HANDLE hHook = GetProp(wnd, EVT_DELETED_HOOK_PROP_NAME);
-		RemoveProp(wnd, EVT_DELETED_HOOK_PROP_NAME);
-		UnhookEvent(hHook);
-	}
+		{
+			HANDLE hHook = GetProp(wnd, EVT_DELETED_HOOK_PROP_NAME);
+			RemoveProp(wnd, EVT_DELETED_HOOK_PROP_NAME);
+			UnhookEvent(hHook);
+		}
 
-	if (ppdh->MarkRead && ppdh->hDbEvent && (acc = GetJidAcc(ppdh->jid))) {
-		ReadNotificationSettings(acc);
-		MarkEventRead(ppdh->hContact, ppdh->hDbEvent);
-		CallService(MS_CLIST_REMOVEEVENT, (WPARAM)ppdh->hContact, (LPARAM)ppdh->hDbEvent);
-	}
-	RemoveProp(wnd, PLUGIN_DATA_PROP_NAME);
-	free(ppdh);
-	return 0;
+		if (ppdh->MarkRead && ppdh->hDbEvent && (acc = GetJidAcc(ppdh->jid))) {
+			ReadNotificationSettings(acc);
+			MarkEventRead(ppdh->hContact, ppdh->hDbEvent);
+			CallService(MS_CLIST_REMOVEEVENT, (WPARAM)ppdh->hContact, (LPARAM)ppdh->hDbEvent);
+		}
+		RemoveProp(wnd, PLUGIN_DATA_PROP_NAME);
+		free(ppdh);
+		return 0;
 
 	case WM_LBUTTONUP:
 		acc = NULL;
@@ -262,25 +262,24 @@ void UnreadMailNotification(LPCSTR acc, LPCTSTR jid, LPCTSTR url, LPCTSTR unread
 void UnreadThreadNotification(LPCSTR acc, LPCTSTR jid, LPCTSTR url, LPCTSTR unreadCount, const MAIL_THREAD_NOTIFICATION *mtn)
 {
 	POPUPDATAT data = { 0 };
-
 	FormatPseudocontactDisplayName(&data.lptzContactName[0], jid, unreadCount);
-	LPTSTR senders = (LPTSTR)malloc(SENDER_COUNT * 100 * sizeof(TCHAR));
-	LPTSTR currSender = senders;
 
-	for (int i = 0; i < SENDER_COUNT && mtn->senders[i].addr; i++) {
-		if (mtn->senders[i].name)
-			mir_sntprintf(currSender, SENDER_COUNT * 100, _T("    %s <%s>\n"), mtn->senders[i].name, mtn->senders[i].addr);
+	CMString tszSenders;
+	for (int i = 0; i < SENDER_COUNT; i++) {
+		const SENDER &p = mtn->senders[i];
+		if (p.addr == NULL)
+			break;
+
+		if (p.name)
+			tszSenders.AppendFormat(_T("    %s <%s>\n"), p.name, p.addr);
 		else
-			mir_sntprintf(currSender, SENDER_COUNT * 100, _T("    %s\n"), mtn->senders[i].addr);
-		currSender += mir_tstrlen(currSender);
+			tszSenders.AppendFormat(_T("    %s\n"), p.addr);
 	}
 
 	if (ReadCheckbox(0, IDC_ADDSNIP, (DWORD)TlsGetValue(itlsSettings)))
-		mir_sntprintf(data.lptzText, SIZEOF(data.lptzText), TranslateTS(FULL_NOTIFICATION_FORMAT), mtn->subj, senders, mtn->snip);
+		mir_sntprintf(data.lptzText, SIZEOF(data.lptzText), TranslateTS(FULL_NOTIFICATION_FORMAT), mtn->subj, tszSenders.c_str(), mtn->snip);
 	else
-		mir_sntprintf(data.lptzText, SIZEOF(data.lptzText), TranslateTS(SHORT_NOTIFICATION_FORMAT), mtn->subj, senders);
-
-	free(senders);
+		mir_sntprintf(data.lptzText, SIZEOF(data.lptzText), TranslateTS(SHORT_NOTIFICATION_FORMAT), mtn->subj, tszSenders.c_str());
 
 	ShowNotification(acc, &data, jid, url, unreadCount);
 }
-- 
cgit v1.2.3