Bug#300849: beepcore-c0: mishandles sending CDATA piggyback data in channel open confirmation

[Sam Couter]

Package: beepcore-c0
Version: 0.2+cvs20030603-1
Tags: patch

xml_normalize_length() and xml_normalize_worker() disagree about the
handling of CDATA sections. This leads to underruns when sending
CDATA piggyback data in channel confirmations.

Not-strictly-correct but probably good-enough-in-nearly-all-cases patch
attached. It'll break if the piggyback data has more than one CDATA
section.
-- 
Sam "Eddie" Couter  |  mailto:[EMAIL PROTECTED]
Debian Developer    |  mailto:[EMAIL PROTECTED]
                    |  jabber:[EMAIL PROTECTED]
OpenPGP fingerprint:  A46B 9BB5 3148 7BEA 1F05  5BD5 8530 03AE DE89 C75C

--- beepcore-c-0.2+cvs20030603.orig/utility/xml_entities.c
+++ beepcore-c-0.2+cvs20030603/utility/xml_entities.c
@@ -297,6 +297,7 @@
 int xml_normalize_worker(char * in, char * out, int outlen) {
   char * entities[256], * thisin, * thisout, * tmp;
   int inchar;
+  char *cdata, *cdataend;
 
   memset(entities, 0, sizeof(char *) * 256);
   entities['<']  = ";tl&";   /* "&lt;"; */
@@ -305,6 +306,9 @@
   entities['\''] = ";sopa&"; /* "&apos;"; */
   entities['&']  = ";pma&";  /* "&amp;";   */
 
+  cdata = strstr(in, "<![CDATA[");
+  if (cdata)
+    cdataend = strstr(cdata, "]]>") + 3;
   inchar = strlen(in);
   thisin = &(in[inchar - 1]);
   thisout = &(out[outlen]);
@@ -312,7 +316,7 @@
   thisout--;
 
   while (inchar) {
-    if (entities[(int)*thisin]) {
+    if (entities[(int)*thisin] && !(cdata && thisin >= cdata && cdataend && 
thisin < cdataend)) {
       tmp = entities[(int)*thisin];
       while (*tmp) {
        *(thisout--) = *(tmp++);

signature.asc
Description: Digital signature