Wed, 21 Jul 2010 03:49:49 +0000
Now we're cooking with the midnight oil!
*** Plucked rev 7d49d1421450a241ef8ebc7588f957cce90cac52 (qulogic@pidgin.im):
Destroy a DC if its corresponding slpcall is going away and it hasn't
established itself yet. Otherwise, it might timeout later and try to
access the old slpcall.
Fixes #12072.
| ChangeLog | file | annotate | diff | comparison | revisions | |
| NEWS | file | annotate | diff | comparison | revisions | |
| libpurple/protocols/msn/slplink.c | file | annotate | diff | comparison | revisions |
--- a/ChangeLog Wed Jul 21 03:36:42 2010 +0000 +++ b/ChangeLog Wed Jul 21 03:49:49 2010 +0000 @@ -9,6 +9,9 @@ * Change HTML sent from ICQ accounts so that official ICQ clients hopefully display it correctly. + MSN: + * Fix a crash related to fast buddy icon transfers. + version 2.7.1 (05/29/2010): General: * Build fixes on OpenSolaris. (Brian Lu)
--- a/NEWS Wed Jul 21 03:36:42 2010 +0000 +++ b/NEWS Wed Jul 21 03:49:49 2010 +0000 @@ -5,7 +5,7 @@ 2.7.2 (07/21/2010): Mark: We discovered a security issue in Pidgin 2.7.0 and 2.7.1 and decided to release a patched version quickly. This release contains - the fix for that crash, and two other minor fixes. + the fix for that crash, and a few other minor fixes. 2.7.1 (05/29/2010): Elliott: Hey, I'm first! How did that happen?! Maybe because of the
--- a/libpurple/protocols/msn/slplink.c Wed Jul 21 03:36:42 2010 +0000 +++ b/libpurple/protocols/msn/slplink.c Wed Jul 21 03:49:49 2010 +0000 @@ -214,11 +214,16 @@ slplink->swboard = NULL; } - /* The slplink has no slpcalls in it, release it from the DC. */ - if (slplink->slp_calls == NULL && slplink->dc != NULL) { - slplink->dc->slplink = NULL; - msn_dc_destroy(slplink->dc); - slplink->dc = NULL; + if (slplink->dc != NULL) { + if ((slplink->dc->state != DC_STATE_ESTABLISHED && slplink->dc->slpcall == slpcall) + || (slplink->slp_calls == NULL)) { + /* The DC is not established and its corresponding slpcall is dead, + * or the slplink has no slpcalls in it and no longer needs the DC. + */ + slplink->dc->slplink = NULL; + msn_dc_destroy(slplink->dc); + slplink->dc = NULL; + } } }