[PATCH] Fix segfault during ITIP parsing.

Guido Günther agx at sigxcpu.org
Sat Jun 5 09:14:00 UTC 2010


Fixes possible NULL pointer dereference. Patch adjusts code to current
evolution git.
---
 plugins/itip-formatter/itip-formatter.c |   17 +++++++++++------
 1 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/plugins/itip-formatter/itip-formatter.c b/plugins/itip-formatter/itip-formatter.c
index 526af07..cf37693 100644
--- a/plugins/itip-formatter/itip-formatter.c
+++ b/plugins/itip-formatter/itip-formatter.c
@@ -2535,7 +2535,8 @@ format_itip (EPlugin *ep, EMFormatHookTarget *target)
 	gchar *classid;
 	struct _itip_puri *puri;
 	CamelDataWrapper *content;
-	CamelStream *mem;
+	CamelStream *stream;
+	GByteArray *byte_array;
 
 	classid = g_strdup_printf("itip:///%s", ((EMFormat *) target->format)->part_id->str);
 
@@ -2561,14 +2562,18 @@ format_itip (EPlugin *ep, EMFormatHookTarget *target)
 
 	/* This is non-gui thread. Download the part for using in the main thread */
 	content = camel_medium_get_content_object ((CamelMedium *) target->part);
-	mem = camel_stream_mem_new ();
-	camel_data_wrapper_decode_to_stream (content, mem);
 
-	if (((CamelStreamMem *) mem)->buffer->len == 0)
+	byte_array = g_byte_array_new ();
+	stream = camel_stream_mem_new_with_byte_array (byte_array);
+	camel_data_wrapper_decode_to_stream (content, stream);
+
+	if (byte_array->len == 0)
 		puri->vcalendar = NULL;
 	else
-		puri->vcalendar = g_strndup ((gchar *)((CamelStreamMem *) mem)->buffer->data, ((CamelStreamMem *) mem)->buffer->len);
-	camel_object_unref (mem);
+		puri->vcalendar = g_strndup (
+			(gchar *) byte_array->data, byte_array->len);
+
+	g_object_unref (stream);
 
 	camel_stream_printf (target->stream, "<table border=0 width=\"100%%\" cellpadding=3><tr>");
 	camel_stream_printf (target->stream, "<td valign=top><object classid=\"%s\"></object></td><td width=100%% valign=top>", classid);
-- 
1.7.1


--6TrnltStXW4iwmi0--





More information about the Pkg-evolution-maintainers mailing list