Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 425152 Fix string length overflow in nsNNTPProtocol::DoCancel

Browse Source 
patch by Pidgeot18@gmail.com r=bienvenu sr=bienvenu


git-svn-id: svn://10.0.0.236/trunk@250279 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
timeless%mozdev.org
2008-04-15 23:18:54 +00:00
parent 4216beb220
commit f9e55befed
1 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
mozilla/mailnews/news/src/nsNNTPProtocol.cpp
View File

@@ -4205,7 +4205,6 @@ PRInt32 nsNNTPProtocol::DoCancel()
char *subject = nsnull;
char *newsgroups = nsnull;
char *distribution = nsnull;
char *other_random_headers = nsnull;
char *body = nsnull;
cancelInfoEntry cancelInfo;
PRBool requireConfirmationForCancel = PR_TRUE;
@@ -4255,13 +4254,15 @@ PRInt32 nsNNTPProtocol::DoCancel()
L = PL_strlen (id);
subject = (char *) PR_Malloc (L + 20);
other_random_headers = (char *) PR_Malloc (L + 20);
body = (char *) PR_Malloc (PL_strlen (XP_AppCodeName) + 100);
nsString alertText;
nsString confirmText;
PRInt32 confirmCancelResult = 0;
// A little early to declare, but the goto causes problems
nsCAutoString otherHeaders;
/* Make sure that this loser isn't cancelling someone else's posting.
Yes, there are occasionally good reasons to do so. Those people
capable of making that decision (news admins) have other tools with
@@ -4326,7 +4327,7 @@ reported here */
goto FAIL;
}
if (!subject || !other_random_headers || !body)
if (!subject || !body)
{
status = MK_OUT_OF_MEMORY;
failure = PR_TRUE;
@@ -4336,13 +4337,13 @@ reported here */
PL_strcpy (subject, "cancel ");
PL_strcat (subject, id);
PL_strcpy (other_random_headers, "Control: cancel ");
PL_strcat (other_random_headers, id);
PL_strcat (other_random_headers, CRLF);
otherHeaders.AppendLiteral("Control: cancel ");
otherHeaders += id;
otherHeaders.AppendLiteral(CRLF);
if (distribution) {
PL_strcat (other_random_headers, "Distribution: ");
PL_strcat (other_random_headers, distribution);
PL_strcat (other_random_headers, CRLF);
otherHeaders.AppendLiteral("Distribution: ");
otherHeaders += distribution;
otherHeaders.AppendLiteral(CRLF);
}
PL_strcpy (body, "This message was cancelled from within ");
@@ -4360,12 +4361,12 @@ reported here */
"Newsgroups: %s" CRLF
"Subject: %s" CRLF
"References: %s" CRLF
"%s" /* other_random_headers, already with CRLF */
"%s" /* otherHeaders, already with CRLF */
CRLF /* body separator */
"%s" /* body, already with CRLF */
"." CRLF, /* trailing message terminator "." */
cancelInfo.from.get(), newsgroups, subject, id,
other_random_headers, body);
otherHeaders.get(), body);
nsCOMPtr<nsIMsgMailNewsUrl> mailnewsurl = do_QueryInterface(m_runningURL);
if (mailnewsurl)
@@ -4410,7 +4411,6 @@ FAIL:
PR_Free (subject);
PR_Free (newsgroups);
PR_Free (distribution);
PR_Free (other_random_headers);
PR_Free (body);
return status;