[gaim-migrate @ 12851]

Fri, 10 Jun 2005 04:42:40 +0000

author
Daniel Atallah <datallah@pidgin.im>
date
Fri, 10 Jun 2005 04:42:40 +0000
changeset 11001
a026aa937d97
parent 11000
89dd47a25272
child 11002
0be28aa755ab

[gaim-migrate @ 12851]
This is basically the same scenario as the previous fix.

src/protocols/msn/msg.c file | annotate | diff | comparison | revisions
--- a/src/protocols/msn/msg.c	Fri Jun 10 04:08:21 2005 +0000
+++ b/src/protocols/msn/msg.c	Fri Jun 10 04:42:40 2005 +0000
@@ -159,9 +159,14 @@
 {
 	MsnSlpHeader header;
 	const char *tmp;
+	int body_len;
 
 	tmp = body;
 
+	if (len < sizeof(header)) {
+		g_return_if_reached();
+	}
+
 	/* Import the header. */
 	memcpy(&header, tmp, sizeof(header));
 	tmp += sizeof(header);
@@ -177,13 +182,14 @@
 	msg->msnslp_header.ack_size   = GUINT64_FROM_LE(header.ack_size);
 
 	/* Import the body. */
+	body_len = len - (tmp - body);
 	/* msg->body_len = msg->msnslp_header.length; */
-	msg->body_len = len - (tmp - body);
 
-	if (msg->body_len > 0)
+	if (body_len > 0) {
+		msg->body_len = len - (tmp - body);
 		msg->body = g_memdup(tmp, msg->body_len);
-
-	tmp += msg->body_len;
+		tmp += body_len;
+	}
 }
 
 void

mercurial