Bug 39464

Summary: gabble shouldn't crash on malformed caps
Product: Telepathy Reporter: David Laban <david.laban>
Component: gabbleAssignee: Telepathy bugs list <telepathy-bugs>
Status: RESOLVED FIXED QA Contact: Telepathy bugs list <telepathy-bugs>
Severity: normal    
Priority: medium CC: daniele.domenichelli, david.laban
Version: git masterKeywords: patch
Hardware: Other   
OS: All   
URL: http://cgit.collabora.com/git/user/alsuren/telepathy-gabble.git/commit/?h=null-caps-39464
Whiteboard:
i915 platform: i915 features:

Description David Laban 2011-07-21 23:22:00 UTC
_caps_disco_cb calls g_str_equal, which is not null-safe.
Comment 1 David Laban 2011-07-21 23:40:27 UTC
Note that this is causing the echobot to fall over too.

For the interested, the thing that triggers it is a missing form type. I wrote a test at http://cgit.freedesktop.org/~alsuren/wocky/commit/?h=qutim-caps-39464 in case anyone knows what the right thing to do here is. I suspect that the answer is just file a bug against qutim.
Comment 2 Will Thompson 2011-07-28 07:41:08 UTC
My reading of XEP-0004 is that the type='' attribute is mandatory, and that in this case it ought really to be result.

<http://xmpp.org/extensions/xep-0004.html#protocol-formtypes> describes type='result' as “… the data is a generic data set.”. <http://xmpp.org/extensions/xep-0004.html#schema> says that the type='' attribute is mandatory.

So qutim is buggy. But clearly so are we. :)

Your patch looks good; here's a regression test for Gabble: <http://cgit.collabora.com/git/user/wjt/telepathy-gabble-wjt.git/commit/?h=null-caps-39464>. The regression test's form is malformed in more crucial ways, too: the form type='' attribute is not part of the XEP-0115 hash, but the FORM_TYPE field (which is different!) is, so omitting it makes for a genuinely unhashable disco reply, even in the presence of a fault-tolerant parser. I tweaked Wocky to accept the absence of type='' (which I don't think we should do, but some future person might) and the test still passed without crashing Gabble, so that's fine then.
Comment 3 Will Thompson 2011-07-29 01:33:19 UTC
*** Bug 39652 has been marked as a duplicate of this bug. ***
Comment 4 Will Thompson 2011-07-29 11:16:54 UTC
Merged to master. Does not affect 0.12.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.