Mercurial > pidgin3 / file diff

--- a/libpurple/protocols/mxit/formcmds.c	Sun May 15 05:41:39 2016 -0300
+++ b/libpurple/protocols/mxit/formcmds.c	Thu Jun 02 13:24:09 2016 -0500
@@ -519,9 +519,9 @@
 	const char* tmp;
 	const char* name;
 	int mode;
-	int nr_columns = 0, nr_rows = 0;
+	unsigned int nr_columns = 0, nr_rows = 0;
 	gchar** coldata;
-	int i, j;
+	unsigned int i, j;
 
 	/* table name */
 	name = g_hash_table_lookup(hash, "nm");
@@ -542,6 +542,12 @@
 	tmp = g_hash_table_lookup(hash, "d");
 	coldata = g_strsplit(tmp, "~", 0);			/* split into entries for each row & column */
 
+	if (g_strv_length(coldata) != (nr_rows * nr_columns)) {
+		purple_debug_info(MXIT_PLUGIN_ID, "Invalid table data: cols=%i rows=%i\n", nr_columns, nr_rows);
+		g_strfreev(coldata);
+		return;
+	}
+
 	purple_debug_info(MXIT_PLUGIN_ID, "Table %s from %s: [cols=%i rows=%i mode=%i]\n", name, mx->from, nr_columns, nr_rows, mode);
 
 	for (i = 0; i < nr_rows; i++) {
@@ -549,6 +555,8 @@
 			purple_debug_info(MXIT_PLUGIN_ID, " Row %i Column %i = %s\n", i, j, coldata[i*nr_columns + j]);
 		}
 	}
+
+	g_strfreev(coldata);
 }