diff options
| author | Bastien Nocera <hadess@hadess.net> | 2013-05-14 15:24:41 +0200 |
|---|---|---|
| committer | Juan A. Suarez Romero <jasuarez@igalia.com> | 2013-05-15 09:28:45 +0200 |
| commit | 2a3958619c174010ecc75e440387ca85217a3288 (patch) | |
| tree | ffac40fbe19a41d8bb1c0d655215541f01715cc5 | |
| parent | a406cd005dfe4bfd0bb817e67e6b6b2d8f20c0ed (diff) | |
raitv: Fix crasher on 64-bit platforms
gsize on 64-bit platforms is a 64-bit integer. Trying to fit a 64-bit
integer in the 32-bit integer we were passed trashed the pointer of the
previous return parameter, in this case the buffer's address.
Pass a pointer to correctly sized integer to avoid this memory
corruption and cast it later as needed.
https://bugzilla.gnome.org/show_bug.cgi?id=700297
| -rw-r--r-- | src/raitv/grl-raitv.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/src/raitv/grl-raitv.c b/src/raitv/grl-raitv.c index 87b3b0c..474db8c 100644 --- a/src/raitv/grl-raitv.c +++ b/src/raitv/grl-raitv.c @@ -392,7 +392,7 @@ proxy_call_search_grlnet_async_cb (GObject *source_object, xmlXPathContextPtr xpath = NULL; xmlXPathObjectPtr obj = NULL; gint i, nb_items = 0; - gint length; + gsize length; GRL_DEBUG ("Response id=%u", op->operation_id); @@ -408,7 +408,7 @@ proxy_call_search_grlnet_async_cb (GObject *source_object, if (!grl_net_wc_request_finish (GRL_NET_WC (source_object), res, &content, - (gsize *) &length, + &length, &wc_error)) { error = g_error_new (GRL_CORE_ERROR, GRL_CORE_ERROR_SEARCH_FAILED, @@ -428,7 +428,7 @@ proxy_call_search_grlnet_async_cb (GObject *source_object, return; } - doc = xmlParseMemory (content, length); + doc = xmlParseMemory (content, (gint) length); if (!doc) { GRL_DEBUG ("Doc failed"); @@ -588,7 +588,7 @@ proxy_call_browse_grlnet_async_cb (GObject *source_object, xmlXPathContextPtr xpath = NULL; xmlXPathObjectPtr obj = NULL; gint i, nb_items = 0; - gint length; + gsize length; GRL_DEBUG ("Response id=%u", op->operation_id); @@ -605,7 +605,7 @@ proxy_call_browse_grlnet_async_cb (GObject *source_object, if (!grl_net_wc_request_finish (GRL_NET_WC (source_object), res, &content, - (gsize *) &length, + &length, &wc_error)) { error = g_error_new (GRL_CORE_ERROR, GRL_CORE_ERROR_SEARCH_FAILED, @@ -625,7 +625,7 @@ proxy_call_browse_grlnet_async_cb (GObject *source_object, return; } - doc = xmlRecoverMemory (content, length); + doc = xmlRecoverMemory (content, (gint) length); if (!doc) { GRL_DEBUG ("Doc failed"); @@ -843,7 +843,7 @@ proxy_call_resolve_grlnet_async_cb (GObject *source_object, GError *wc_error = NULL; GError *error = NULL; gchar *content = NULL; - gint length; + gsize length; gchar *value; gchar *thumbnail; gchar **tokens; @@ -859,7 +859,7 @@ proxy_call_resolve_grlnet_async_cb (GObject *source_object, if (!grl_net_wc_request_finish (GRL_NET_WC (source_object), res, &content, - (gsize *) &length, + &length, &wc_error)) { error = g_error_new (GRL_CORE_ERROR, GRL_CORE_ERROR_SEARCH_FAILED, @@ -878,7 +878,7 @@ proxy_call_resolve_grlnet_async_cb (GObject *source_object, return; } - doc = xmlRecoverMemory (content, length); + doc = xmlRecoverMemory (content, (gint) length); if (!doc) { GRL_DEBUG ("Doc failed"); |