[patch] patch to fix itip-formatter segfault when reading meeting requests

0001-Fix-segfault-during-ITIP-parsing.patch (text/plain), 2.00 KB, created by Iain Buchanan on 2010-06-21 01:04:37 UTC

>From 30a7393975b8fc8e35d3e2b30e7711ed7e33dd31 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guido=20G=C3=BCnther?= <agx@xxxxxxxxxxx>
Date: Sat, 5 Jun 2010 11:14:00 +0200
Subject: [PATCH] Fix segfault during ITIP parsing.

Fixes possible NULL pointer dereference. Patch adjusts code to current
evolution git.
---
 plugins/itip-formatter/itip-formatter.c |   17 +++++++++++------
 1 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/plugins/itip-formatter/itip-formatter.c b/plugins/itip-formatter/itip-formatter.c
index 526af07..cf37693 100644
--- a/plugins/itip-formatter/itip-formatter.c
+++ b/plugins/itip-formatter/itip-formatter.c
@@ -2535,7 +2535,8 @@ format_itip (EPlugin *ep, EMFormatHookTarget *target)
 	gchar *classid;
 	struct _itip_puri *puri;
 	CamelDataWrapper *content;
-	CamelStream *mem;
+	CamelStream *stream;
+	GByteArray *byte_array;
 
 	classid = g_strdup_printf("itip:///%s", ((EMFormat *) target->format)->part_id->str);
 
@@ -2561,14 +2562,18 @@ format_itip (EPlugin *ep, EMFormatHookTarget *target)
 
 	/* This is non-gui thread. Download the part for using in the main thread */
 	content = camel_medium_get_content_object ((CamelMedium *) target->part);
-	mem = camel_stream_mem_new ();
-	camel_data_wrapper_decode_to_stream (content, mem);
 
-	if (((CamelStreamMem *) mem)->buffer->len == 0)
+	byte_array = g_byte_array_new ();
+	stream = camel_stream_mem_new_with_byte_array (byte_array);
+	camel_data_wrapper_decode_to_stream (content, stream);
+
+	if (byte_array->len == 0)
 		puri->vcalendar = NULL;
 	else
-		puri->vcalendar = g_strndup ((gchar *)((CamelStreamMem *) mem)->buffer->data, ((CamelStreamMem *) mem)->buffer->len);
-	camel_object_unref (mem);
+		puri->vcalendar = g_strndup (
+			(gchar *) byte_array->data, byte_array->len);
+
+	g_object_unref (stream);
 
 	camel_stream_printf (target->stream, "<table border=0 width=\"100%%\" cellpadding=3><tr>");
 	camel_stream_printf (target->stream, "<td valign=top><object classid=\"%s\"></object></td><td width=100%% valign=top>", classid);
-- 
1.7.1