Bug 646227 — Possible overflow in persona-view:drag_data_get

I think it was a fluke that this code worked in the first place, since it was
accessing arrays with indices which were out of range, and which wouldn't have
corresponded to the correct entries even if they were in range.

This should fix the mapping between DND types and DND URIs/atoms in the
contact list, individual and persona views.

Closes: bgo#646227

diff --git a/libempathy-gtk/empathy-contact-list-view.c b/libempathy-gtk/empathy-contact-list-view.c
index 0b7cabd91b2b0cdb170451b995fe99f7dbeaef13..dace4f9090041b64c2e557c56dbd7e71a9af9887 100644 (file)
--- a/libempathy-gtk/empathy-contact-list-view.c
+++ b/libempathy-gtk/empathy-contact-list-view.c
@@ -112,9 +112,6 @@ static const GtkTargetEntry drag_types_source[] = {
        { "text/contact-id", 0, DND_DRAG_TYPE_CONTACT_ID },
 };
 
-static GdkAtom drag_atoms_dest[G_N_ELEMENTS (drag_types_dest)];
-static GdkAtom drag_atoms_source[G_N_ELEMENTS (drag_types_source)];
-
 enum {
        DRAG_CONTACT_RECEIVED,
        LAST_SIGNAL
@@ -761,7 +758,8 @@ contact_list_view_drag_data_get (GtkWidget        *widget,
        str = g_strconcat (account_id, ":", contact_id, NULL);
 
        if (info == DND_DRAG_TYPE_CONTACT_ID) {
-               gtk_selection_data_set (selection, drag_atoms_source[info], 8,
+               gtk_selection_data_set (selection,
+                                       gdk_atom_intern ("text/contact-id", FALSE), 8,
                                        (guchar *) str, strlen (str) + 1);
        }
 
@@ -1506,7 +1504,6 @@ contact_list_view_constructed (GObject *object)
        EmpathyContactListViewPriv *priv = GET_PRIV (view);
        GtkCellRenderer            *cell;
        GtkTreeViewColumn          *col;
-       guint                       i;
 
        priv->filter = GTK_TREE_MODEL_FILTER (gtk_tree_model_filter_new (
                        GTK_TREE_MODEL (priv->store), NULL));
@@ -1638,17 +1635,6 @@ contact_list_view_constructed (GObject *object)
 
        /* Actually add the column now we have added all cell renderers */
        gtk_tree_view_append_column (GTK_TREE_VIEW (view), col);
-
-       /* Drag & Drop. */
-       for (i = 0; i < G_N_ELEMENTS (drag_types_dest); ++i) {
-               drag_atoms_dest[i] = gdk_atom_intern (drag_types_dest[i].target,
-                                                     FALSE);
-       }
-
-       for (i = 0; i < G_N_ELEMENTS (drag_types_source); ++i) {
-               drag_atoms_source[i] = gdk_atom_intern (drag_types_source[i].target,
-                                                       FALSE);
-       }
 }
 
 static void

diff --git a/libempathy-gtk/empathy-individual-view.c b/libempathy-gtk/empathy-individual-view.c
index 634c391a8d76b238ebaeaf81581ee5f7cc25463f..aad46c5bf16fac6f541009c87cbd1b9bfec4803f 100644 (file)
--- a/libempathy-gtk/empathy-individual-view.c
+++ b/libempathy-gtk/empathy-individual-view.c
@@ -116,13 +116,14 @@ enum
 
 /* TODO: re-add DRAG_TYPE_CONTACT_ID, for the case that we're dragging around
  * specific EmpathyContacts (between/in/out of Individuals) */
-enum DndDragType
+typedef enum
 {
-  DND_DRAG_TYPE_INDIVIDUAL_ID,
+  DND_DRAG_TYPE_UNKNOWN = -1,
+  DND_DRAG_TYPE_INDIVIDUAL_ID = 0,
   DND_DRAG_TYPE_PERSONA_ID,
   DND_DRAG_TYPE_URI_LIST,
   DND_DRAG_TYPE_STRING,
-};
+} DndDragType;
 
 #define DRAG_TYPE(T,I) \
   { (gchar *) T, 0, I }
@@ -143,7 +144,6 @@ static const GtkTargetEntry drag_types_source[] = {
 #undef DRAG_TYPE
 
 static GdkAtom drag_atoms_dest[G_N_ELEMENTS (drag_types_dest)];
-static GdkAtom drag_atoms_source[G_N_ELEMENTS (drag_types_source)];
 
 enum
 {
@@ -598,6 +598,8 @@ individual_view_drag_motion (GtkWidget *widget,
   gboolean cleanup = TRUE;
   gboolean retval = TRUE;
   GtkAllocation allocation;
+  guint i;
+  DndDragType drag_type = DND_DRAG_TYPE_UNKNOWN;
 
   priv = GET_PRIV (EMPATHY_INDIVIDUAL_VIEW (widget));
   model = gtk_tree_view_get_model (GTK_TREE_VIEW (widget));
@@ -649,8 +651,18 @@ individual_view_drag_motion (GtkWidget *widget,
   target = gtk_drag_dest_find_target (widget, context, NULL);
   gtk_tree_model_get_iter (model, &iter, path);
 
-  if (target == drag_atoms_dest[DND_DRAG_TYPE_URI_LIST] ||
-      target == drag_atoms_dest[DND_DRAG_TYPE_STRING])
+  /* Determine the DndDragType of the data */
+  for (i = 0; i < G_N_ELEMENTS (drag_atoms_dest); i++)
+    {
+      if (target == drag_atoms_dest[i])
+        {
+          drag_type = drag_types_dest[i].info;
+          break;
+        }
+    }
+
+  if (drag_type == DND_DRAG_TYPE_URI_LIST ||
+      drag_type == DND_DRAG_TYPE_STRING)
     {
       /* This is a file drag, and it can only be dropped on contacts,
        * not groups.
@@ -695,10 +707,10 @@ individual_view_drag_motion (GtkWidget *widget,
       if (individual != NULL)
         g_object_unref (individual);
     }
-  else if ((target == drag_atoms_dest[DND_DRAG_TYPE_INDIVIDUAL_ID] &&
+  else if ((drag_type == DND_DRAG_TYPE_INDIVIDUAL_ID &&
       (priv->view_features & EMPATHY_INDIVIDUAL_VIEW_FEATURE_GROUPS_CHANGE ||
        priv->drag_row == NULL)) ||
-      (target == drag_atoms_dest[DND_DRAG_TYPE_PERSONA_ID] &&
+      (drag_type == DND_DRAG_TYPE_PERSONA_ID &&
        priv->view_features & EMPATHY_INDIVIDUAL_VIEW_FEATURE_PERSONA_DROP))
     {
       /* If target != GDK_NONE, then we have a contact (individual or persona)
@@ -843,7 +855,8 @@ individual_view_drag_data_get (GtkWidget *widget,
 
   if (info == DND_DRAG_TYPE_INDIVIDUAL_ID)
     {
-      gtk_selection_data_set (selection, drag_atoms_source[info], 8,
+      gtk_selection_data_set (selection,
+          gdk_atom_intern ("text/individual-id", FALSE), 8,
           (guchar *) individual_id, strlen (individual_id) + 1);
     }
 
@@ -1923,12 +1936,6 @@ individual_view_constructed (GObject *object)
     {
       drag_atoms_dest[i] = gdk_atom_intern (drag_types_dest[i].target, FALSE);
     }
-
-  for (i = 0; i < G_N_ELEMENTS (drag_types_source); ++i)
-    {
-      drag_atoms_source[i] = gdk_atom_intern (drag_types_source[i].target,
-          FALSE);
-    }
 }
 
 static void

diff --git a/libempathy-gtk/empathy-persona-view.c b/libempathy-gtk/empathy-persona-view.c
index 289f6fac9e22400dbb784b16c37477a88ec76a93..6d1629651f6e6cb5d0f49d89dc3f58670cee5c40 100644 (file)
--- a/libempathy-gtk/empathy-persona-view.c
+++ b/libempathy-gtk/empathy-persona-view.c
@@ -84,12 +84,13 @@ enum
   PROP_FEATURES,
 };
 
-enum DndDragType
+typedef enum
 {
-  DND_DRAG_TYPE_INDIVIDUAL_ID,
+  DND_DRAG_TYPE_UNKNOWN = -1,
+  DND_DRAG_TYPE_INDIVIDUAL_ID = 0,
   DND_DRAG_TYPE_PERSONA_ID,
   DND_DRAG_TYPE_STRING,
-};
+} DndDragType;
 
 #define DRAG_TYPE(T,I) \
   { (gchar *) T, 0, I }
@@ -107,7 +108,6 @@ static const GtkTargetEntry drag_types_source[] = {
 #undef DRAG_TYPE
 
 static GdkAtom drag_atoms_dest[G_N_ELEMENTS (drag_types_dest)];
-static GdkAtom drag_atoms_source[G_N_ELEMENTS (drag_types_source)];
 
 enum
 {
@@ -408,10 +408,22 @@ drag_motion (GtkWidget *widget,
 {
   EmpathyPersonaView *self = EMPATHY_PERSONA_VIEW (widget);
   GdkAtom target;
+  guint i;
+  DndDragType drag_type = DND_DRAG_TYPE_UNKNOWN;
 
   target = gtk_drag_dest_find_target (GTK_WIDGET (self), context, NULL);
 
-  if (target == drag_atoms_dest[DND_DRAG_TYPE_INDIVIDUAL_ID])
+  /* Determine the DndDragType of the data */
+  for (i = 0; i < G_N_ELEMENTS (drag_atoms_dest); i++)
+    {
+      if (target == drag_atoms_dest[i])
+        {
+          drag_type = drag_types_dest[i].info;
+          break;
+        }
+    }
+
+  if (drag_type == DND_DRAG_TYPE_INDIVIDUAL_ID)
     {
       GtkTreePath *path;
 
@@ -457,7 +469,8 @@ drag_data_get (GtkWidget *widget,
     return;
 
   persona_uid = folks_persona_get_uid (persona);
-  gtk_selection_data_set (selection, drag_atoms_source[info], 8,
+  gtk_selection_data_set (selection,
+      gdk_atom_intern ("text/persona-id", FALSE), 8,
       (guchar *) persona_uid, strlen (persona_uid) + 1);
 
   g_object_unref (persona);
@@ -605,9 +618,6 @@ constructed (GObject *object)
   /* Drag & Drop. */
   for (i = 0; i < G_N_ELEMENTS (drag_types_dest); ++i)
     drag_atoms_dest[i] = gdk_atom_intern (drag_types_dest[i].target, FALSE);
-
-  for (i = 0; i < G_N_ELEMENTS (drag_types_source); ++i)
-    drag_atoms_source[i] = gdk_atom_intern (drag_types_source[i].target, FALSE);
 }
 
 static void