[Bug 37701] telepathy-salut-0.5.0 build failure: error: 'attr' may be used uninitialized in this function [-Wuninitialized]

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=37701

--- Comment #3 from Will Thompson <will.thompson at collabora.co.uk> 2012-07-23 14:15:26 PDT ---
Created attachment 64543
  --> https://bugs.freedesktop.org/attachment.cgi?id=64543
SCRAM: correct logic in server-final message handling

The server-final message looks like this:

   server-final-message = (server-error / verifier)
                        ["," extensions]
   server-error = "e=" server-error-value
   verifier        = "v=" base64

The code was trying to check “is there at least one attribute, and is it
a verifier?”. But instead it was checking “is there at least one
attribute, and if not, is the non-existant attribute a verifier?” by
comparing the uninitialized 'attr' variable to 'v'.

I've checked other calls to scram_get_next_attr_value() and they seem to
get the logic the right way round.

This bug does not cause a security vulnerability. If the uninitialized
'attr' variable happens to contain the character 'v', then the following
call to scram_check_server_verification() will compare the contents of
value (which ought to be a verification string, but is NULL) to the
verification string as calculated by Wocky (which is not NULL) and so
Wocky will abort the connection.

Thanks to Ed Catmur for reporting the use of an uninitialized variable
on <https://bugs.freedesktop.org/show_bug.cgi?id=37701>.

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA Contact for the bug.
You are the assignee for the bug.