evolution-data-server r8971 - in branches/gnome-2-22/addressbook: . libebook

[mcrha svn gnome org]

Author: mcrha
Date: Thu Jun 12 14:05:50 2008
New Revision: 8971
URL: http://svn.gnome.org/viewvc/evolution-data-server?rev=8971&view=rev

Log:
2008-06-12  Paul Smith  <psmith gnu org>

	** Fix for bug #534111
	Copying past the end of the buffer can cause core dumps.

	* libebook/e-vcard.c (e_vcard_to_string_vcard_30): Loop on the # of
	chars rather than the length of string, and break out before copying
	past the end of the string.



Modified:
   branches/gnome-2-22/addressbook/ChangeLog
   branches/gnome-2-22/addressbook/libebook/e-vcard.c

Modified: branches/gnome-2-22/addressbook/libebook/e-vcard.c
==============================================================================
--- branches/gnome-2-22/addressbook/libebook/e-vcard.c	(original)
+++ branches/gnome-2-22/addressbook/libebook/e-vcard.c	Thu Jun 12 14:05:50 2008
@@ -906,13 +906,17 @@
 			gchar *pos1 = attr_str->str;
 			gchar *pos2 = pos1;
 			pos2 = g_utf8_offset_to_pointer (pos2, 75);
+			len -= 75;
 
-			do {
+			while (1) {
 				g_string_append_len (fold_str, pos1, pos2 - pos1);
 				g_string_append (fold_str, CRLF " ");
 				pos1 = pos2;
+				if (len <= 74)
+					break;
 				pos2 = g_utf8_offset_to_pointer (pos2, 74);
-			} while (pos2 < attr_str->str + attr_str->len);
+				len -= 74;
+			}
 			g_string_append (fold_str, pos1);
 			g_string_free (attr_str, TRUE);
 			attr_str = fold_str;