From 3fdaf4c9226a285e40da8fabb83fc5c5fcacce95 Mon Sep 17 00:00:00 2001
From: Milan Crha <mcrha@redhat.com>
Date: Mon, 15 Feb 2010 20:40:24 +0000
Subject: Bug #607651 - Crashed with SIGSEGV in get_SPropValue

---
Index: evolution-mapi-0.28.2/src/addressbook/e-book-backend-mapi.c
===================================================================
--- evolution-mapi-0.28.2.orig/src/addressbook/e-book-backend-mapi.c
+++ evolution-mapi-0.28.2/src/addressbook/e-book-backend-mapi.c
@@ -458,7 +458,7 @@ mapi_book_build_props (struct SPropValue
 	for (i=0; i<13; i++)
 		printf("hex %x\n", SPropTagArray->aulPropTag[i]);
 	i=0;
-	props = g_new (struct SPropValue, 50); //FIXME: Correct value tbd
+	props = g_new0 (struct SPropValue, 50); //FIXME: Correct value tbd
 	set_str_value ( E_CONTACT_FILE_AS, SPropTagArray->aulPropTag[0]);
 
 	set_str_value (E_CONTACT_FULL_NAME, PR_DISPLAY_NAME);
Index: evolution-mapi-0.28.2/src/camel/camel-mapi-folder.c
===================================================================
--- evolution-mapi-0.28.2.orig/src/camel/camel-mapi-folder.c
+++ evolution-mapi-0.28.2/src/camel/camel-mapi-folder.c
@@ -538,7 +538,7 @@ mapi_update_cache (CamelFolder *folder,
  				gchar *formatted_id = NULL;
 				const char *name, *display_name;
  				guint32 *type = NULL;
- 				struct SRow aRow;
+ 				struct SRow *aRow;
  				ExchangeMAPIRecipient *recip = (ExchangeMAPIRecipient *)(l->data);
  				
  				/*Can't continue when there is no email-id*/
@@ -546,18 +546,16 @@ mapi_update_cache (CamelFolder *folder,
  					continue;
  				
  				/* Build a SRow structure */
- 				aRow.ulAdrEntryPad = 0;
- 				aRow.cValues = recip->out.all_cValues;
- 				aRow.lpProps = recip->out.all_lpProps;
+ 				aRow = &recip->out_SRow;
 
- 				type = (uint32_t *) find_SPropValue_data(&aRow, PR_RECIPIENT_TYPE);
+ 				type = (uint32_t *) find_SPropValue_data (aRow, PR_RECIPIENT_TYPE);
 
 				if (type) {
- 					name = (const char *) find_SPropValue_data(&aRow, PR_DISPLAY_NAME);
- 					name = name ? name : (const char *) find_SPropValue_data(&aRow, PR_RECIPIENT_DISPLAY_NAME);
- 					name = name ? name : (const char *) find_SPropValue_data(&aRow, 
+ 					name = (const char *) find_SPropValue_data (aRow, PR_DISPLAY_NAME);
+ 					name = name ? name : (const char *) find_SPropValue_data (aRow, PR_RECIPIENT_DISPLAY_NAME);
+ 					name = name ? name : (const char *) find_SPropValue_data (aRow, 
  												 PR_RECIPIENT_DISPLAY_NAME_UNICODE);
- 					name = name ? name : (const char *) find_SPropValue_data(&aRow, 
+ 					name = name ? name : (const char *) find_SPropValue_data (aRow, 
  												 PR_7BIT_DISPLAY_NAME_UNICODE);
  					display_name = name ? name : recip->email_id;
  					formatted_id = camel_internet_address_format_address(display_name, recip->email_id);
@@ -1343,7 +1341,7 @@ mapi_msg_set_recipient_list (CamelMimeMe
 		const char *name = NULL;
 		uint32_t rcpt_type = MAPI_TO;
 		uint32_t *type = NULL; 
-		struct SRow aRow;
+		struct SRow *aRow;
 		ExchangeMAPIRecipient *recip = (ExchangeMAPIRecipient *)(l->data);
 		
 		/*Can't continue when there is no email-id*/
@@ -1351,17 +1349,15 @@ mapi_msg_set_recipient_list (CamelMimeMe
 			continue;
 		
 		/* Build a SRow structure */
-		aRow.ulAdrEntryPad = 0;
-		aRow.cValues = recip->out.all_cValues;
-		aRow.lpProps = recip->out.all_lpProps;
+		aRow = &recip->out_SRow;
 		
 		/*Name is probably available in one of these props.*/
-		name = (const char *) find_SPropValue_data(&aRow, PR_DISPLAY_NAME);
-		name = name ? name : (const char *) find_SPropValue_data(&aRow, PR_RECIPIENT_DISPLAY_NAME);
-		name = name ? name : (const char *) find_SPropValue_data(&aRow, PR_RECIPIENT_DISPLAY_NAME_UNICODE);
-		name = name ? name : (const char *) find_SPropValue_data(&aRow, PR_7BIT_DISPLAY_NAME_UNICODE);
+		name = (const char *) find_SPropValue_data (aRow, PR_DISPLAY_NAME);
+		name = name ? name : (const char *) find_SPropValue_data (aRow, PR_RECIPIENT_DISPLAY_NAME);
+		name = name ? name : (const char *) find_SPropValue_data (aRow, PR_RECIPIENT_DISPLAY_NAME_UNICODE);
+		name = name ? name : (const char *) find_SPropValue_data (aRow, PR_7BIT_DISPLAY_NAME_UNICODE);
 
-		type = (uint32_t *) find_SPropValue_data(&aRow, PR_RECIPIENT_TYPE);
+		type = (uint32_t *) find_SPropValue_data (aRow, PR_RECIPIENT_TYPE);
 		
 		/*Fallbacks. Not good*/
 		display_name = name ? g_strdup (name) : g_strdup (recip->email_id);
Index: evolution-mapi-0.28.2/src/camel/camel-mapi-utils.c
===================================================================
--- evolution-mapi-0.28.2.orig/src/camel/camel-mapi-utils.c
+++ evolution-mapi-0.28.2/src/camel/camel-mapi-utils.c
@@ -79,8 +79,8 @@ mapi_item_add_recipient (const char *rec
 
 	/* this memory should be freed somewhere, perhaps in the existing
 	 * exchange_mapi_util_free_recipient_list() */
-	recipient->in.req_lpProps = g_new0 (struct SPropValue, 2);
 	recipient->in.req_cValues = 2;
+	recipient->in.req_lpProps = g_new0 (struct SPropValue, recipient->in.req_cValues + 1);
 
 	set_SPropValue_proptag (&(recipient->in.req_lpProps[0]), PR_RECIPIENT_TYPE, (const void *) &type);
 
@@ -88,8 +88,8 @@ mapi_item_add_recipient (const char *rec
 	set_SPropValue_proptag (&(recipient->in.req_lpProps[1]), PR_SEND_INTERNET_ENCODING, (const void *)&val);
 
 	/* External recipient properties - set them only when the recipient is unresolved */
-	recipient->in.ext_lpProps = g_new0 (struct SPropValue, 7);
 	recipient->in.ext_cValues = 7;
+	recipient->in.ext_lpProps = g_new0 (struct SPropValue, recipient->in.ext_cValues + 1);
 
 	val = DT_MAILUSER;
 	set_SPropValue_proptag (&(recipient->in.ext_lpProps[0]), PR_DISPLAY_TYPE, (const void *)&val);
@@ -204,7 +204,7 @@ mapi_item_add_attach (MapiItem *item, Ca
 	
 	item_attach = g_new0 (ExchangeMAPIAttachment, 1);
 
-	item_attach->lpProps = g_new0 (struct SPropValue, 6);
+	item_attach->lpProps = g_new0 (struct SPropValue, 6 + 1);
 
 	flag = ATTACH_BY_VALUE; 
 	set_SPropValue_proptag(&(item_attach->lpProps[i++]), PR_ATTACH_METHOD, (const void *) (&flag));
@@ -404,7 +404,7 @@ camel_mapi_utils_create_item_build_props
 	uint32_t *cpid = g_new0 (uint32_t, 1);
 	int i=0;
 
-	props = g_new0 (struct SPropValue, 11);
+	props = g_new0 (struct SPropValue, 11 + 1);
 
 	*cpid = 65001; /* UTF8 */
 	set_SPropValue_proptag(&props[i++], PR_INTERNET_CPID, cpid);
Index: evolution-mapi-0.28.2/src/libexchangemapi/exchange-mapi-cal-utils.c
===================================================================
--- evolution-mapi-0.28.2.orig/src/libexchangemapi/exchange-mapi-cal-utils.c
+++ evolution-mapi-0.28.2/src/libexchangemapi/exchange-mapi-cal-utils.c
@@ -235,7 +235,7 @@ exchange_mapi_cal_util_fetch_attachments
 			attach_item = g_new0 (ExchangeMAPIAttachment, 1);
 
 			attach_item->cValues = 4; 
-			attach_item->lpProps = g_new0 (struct SPropValue, 4); 
+			attach_item->lpProps = g_new0 (struct SPropValue, attach_item->cValues + 1);
 
 			flag = ATTACH_BY_VALUE; 
 			set_SPropValue_proptag(&(attach_item->lpProps[0]), PR_ATTACH_METHOD, (const void *) (&flag));
@@ -305,8 +305,8 @@ exchange_mapi_cal_util_fetch_organizer (
 			recipient->email_id = (org);
 
 		/* Required properties - set them always */
-		recipient->in.req_lpProps = g_new0 (struct SPropValue, 5);
 		recipient->in.req_cValues = 5;
+		recipient->in.req_lpProps = g_new0 (struct SPropValue, recipient->in.req_cValues + 1);
 
 		val = 0;
 		set_SPropValue_proptag (&(recipient->in.req_lpProps[0]), PR_SEND_INTERNET_ENCODING, (const void *)&val);
@@ -327,8 +327,8 @@ exchange_mapi_cal_util_fetch_organizer (
 		set_SPropValue_proptag (&(recipient->in.req_lpProps[4]), PR_RECIPIENT_DISPLAY_NAME, (const void *)(str));
 
 		/* External recipient properties - set them only when the recipient is unresolved */
-		recipient->in.ext_lpProps = g_new0 (struct SPropValue, 5);
 		recipient->in.ext_cValues = 5;
+		recipient->in.ext_lpProps = g_new0 (struct SPropValue, recipient->in.ext_cValues + 1);
 
 		val = DT_MAILUSER;
 		set_SPropValue_proptag (&(recipient->in.ext_lpProps[0]), PR_DISPLAY_TYPE, (const void *)&val);
@@ -377,8 +377,8 @@ exchange_mapi_cal_util_fetch_recipients
 			recipient->email_id = (str);
 
 		/* Required properties - set them always */
-		recipient->in.req_lpProps = g_new0 (struct SPropValue, 5);
 		recipient->in.req_cValues = 5;
+		recipient->in.req_lpProps = g_new0 (struct SPropValue, recipient->in.req_cValues + 1);
 
 		val = 0;
 		set_SPropValue_proptag (&(recipient->in.req_lpProps[0]), PR_SEND_INTERNET_ENCODING, (const void *)&val);
@@ -400,8 +400,8 @@ exchange_mapi_cal_util_fetch_recipients
 		set_SPropValue_proptag (&(recipient->in.req_lpProps[4]), PR_RECIPIENT_DISPLAY_NAME, (const void *)(str));
 
 		/* External recipient properties - set them only when the recipient is unresolved */
-		recipient->in.ext_lpProps = g_new0 (struct SPropValue, 7);
 		recipient->in.ext_cValues = 7;
+		recipient->in.ext_lpProps = g_new0 (struct SPropValue, recipient->in.ext_cValues + 1);
 
 		val = DT_MAILUSER;
 		set_SPropValue_proptag (&(recipient->in.ext_lpProps[0]), PR_DISPLAY_TYPE, (const void *)&val);
@@ -493,15 +493,15 @@ ical_attendees_from_props (icalcomponent
 		else 
 			continue;
 
-		flags = (const uint32_t *) get_SPropValue(recip->out.all_lpProps, PR_RECIPIENTS_FLAGS);
+		flags = (const uint32_t *) get_SPropValue_SRow_data (&recip->out_SRow, PR_RECIPIENTS_FLAGS);
 
 		if (flags && (*flags & RECIP_ORGANIZER)) {
 			prop = icalproperty_new_organizer (val);
 
 			/* CN */
-			str = (const char *) exchange_mapi_util_find_SPropVal_array_propval(recip->out.all_lpProps, PR_RECIPIENT_DISPLAY_NAME);
+			str = (const char *) exchange_mapi_util_find_row_propval (&recip->out_SRow, PR_RECIPIENT_DISPLAY_NAME);
 			if (!str)
-				str = (const char *) exchange_mapi_util_find_SPropVal_array_propval(recip->out.all_lpProps, PR_DISPLAY_NAME);
+				str = (const char *) exchange_mapi_util_find_row_propval (&recip->out_SRow, PR_DISPLAY_NAME);
 			if (str) {
 				param = icalparameter_new_cn (str);
 				icalproperty_add_parameter (prop, param);
@@ -510,9 +510,9 @@ ical_attendees_from_props (icalcomponent
 			prop = icalproperty_new_attendee (val);
 
 			/* CN */
-			str = (const char *) exchange_mapi_util_find_SPropVal_array_propval(recip->out.all_lpProps, PR_RECIPIENT_DISPLAY_NAME);
+			str = (const char *) exchange_mapi_util_find_row_propval (&recip->out_SRow, PR_RECIPIENT_DISPLAY_NAME);
 			if (!str)
-				str = (const char *) exchange_mapi_util_find_SPropVal_array_propval(recip->out.all_lpProps, PR_DISPLAY_NAME);
+				str = (const char *) exchange_mapi_util_find_row_propval (&recip->out_SRow, PR_DISPLAY_NAME);
 			if (str) {
 				param = icalparameter_new_cn (str);
 				icalproperty_add_parameter (prop, param);
@@ -521,11 +521,11 @@ ical_attendees_from_props (icalcomponent
 			param = icalparameter_new_rsvp (rsvp ? ICAL_RSVP_TRUE : ICAL_RSVP_FALSE);
 			icalproperty_add_parameter (prop, param);
 			/* PARTSTAT */
-			ui32 = (const uint32_t *) get_SPropValue(recip->out.all_lpProps, PR_RECIPIENT_TRACKSTATUS);
+			ui32 = (const uint32_t *) get_SPropValue_SRow_data (&recip->out_SRow, PR_RECIPIENT_TRACKSTATUS);
 			param = icalparameter_new_partstat (get_partstat_from_trackstatus (ui32 ? *ui32 : olResponseNone));
 			icalproperty_add_parameter (prop, param);
 			/* ROLE */
-			ui32 = (const uint32_t *) get_SPropValue(recip->out.all_lpProps, PR_RECIPIENT_TYPE);
+			ui32 = (const uint32_t *) get_SPropValue_SRow_data (&recip->out_SRow, PR_RECIPIENT_TYPE);
 			param = icalparameter_new_role (get_role_from_type (ui32 ? *ui32 : olTo));
 			icalproperty_add_parameter (prop, param);
 #if 0
@@ -1629,7 +1629,7 @@ exchange_mapi_cal_util_build_props (stru
 	} 
 
 	d(g_debug ("Allocating space for %d props ", flag32));
-	props = g_new0 (struct SPropValue, flag32);
+	props = g_new0 (struct SPropValue, flag32 + 1);
 
 	/* PR_MESSAGE_CLASS needs to be set appropriately */					/* propcount++ */
 
Index: evolution-mapi-0.28.2/src/libexchangemapi/exchange-mapi-connection.c
===================================================================
--- evolution-mapi-0.28.2.orig/src/libexchangemapi/exchange-mapi-connection.c
+++ evolution-mapi-0.28.2/src/libexchangemapi/exchange-mapi-connection.c
@@ -251,7 +251,7 @@ exchange_mapi_util_read_generic_stream (
 
 		/* Build a mapi_SPropValue_array structure */
 		properties_array.cValues = 1; 
-		properties_array.lpProps = talloc_array (mem_ctx, struct mapi_SPropValue, properties_array.cValues);
+		properties_array.lpProps = talloc_zero_array (mem_ctx, struct mapi_SPropValue, properties_array.cValues + 1);
 		properties_array.lpProps[0].ulPropTag = proptag; 
 		/* This call is needed in case the read stream was a named prop. */
 		mapi_SPropValue_array_named (obj_message, &properties_array);
@@ -856,8 +856,9 @@ exchange_mapi_util_get_recipients (mapi_
 			mapidump_SRow (&(rows_recip.aRow[i_row_recip]), " ");
 		}
 
-		recipient->out.all_lpProps = talloc_steal ((TALLOC_CTX *)recipient->mem_ctx, rows_recip.aRow[i_row_recip].lpProps);
-		recipient->out.all_cValues = rows_recip.aRow[i_row_recip].cValues;
+		recipient->out_SRow.ulAdrEntryPad = rows_recip.aRow[i_row_recip].ulAdrEntryPad;
+		recipient->out_SRow.cValues = rows_recip.aRow[i_row_recip].cValues;
+		recipient->out_SRow.lpProps = talloc_steal ((TALLOC_CTX *)recipient->mem_ctx, rows_recip.aRow[i_row_recip].lpProps);
 
 		*recip_list = g_slist_append (*recip_list, recipient);
 	}
@@ -1290,8 +1291,8 @@ exchange_mapi_connection_fetch_items   (
 
 				/* Conversion from SPropValue to mapi_SPropValue. (no padding here) */
 				properties_array.cValues = prop_count;
-				properties_array.lpProps = talloc_array (mem_ctx, struct mapi_SPropValue, 
-									 prop_count);
+				properties_array.lpProps = talloc_zero_array (mem_ctx, struct mapi_SPropValue, 
+									 prop_count + 1);
 				for (k=0; k < prop_count; k++)
 					cast_mapi_SPropValue(&properties_array.lpProps[k], &lpProps[k]);
 
@@ -1470,7 +1471,7 @@ exchange_mapi_connection_fetch_item (map
 
 		/* Conversion from SPropValue to mapi_SPropValue. (no padding here) */
 		properties_array.cValues = prop_count;
-		properties_array.lpProps = talloc_array (mem_ctx, struct mapi_SPropValue, prop_count);
+		properties_array.lpProps = talloc_zero_array (mem_ctx, struct mapi_SPropValue, prop_count + 1);
 		for (k=0; k < prop_count; k++)
 			cast_mapi_SPropValue(&properties_array.lpProps[k], &lpProps[k]);
 
Index: evolution-mapi-0.28.2/src/libexchangemapi/exchange-mapi-connection.h
===================================================================
--- evolution-mapi-0.28.2.orig/src/libexchangemapi/exchange-mapi-connection.h
+++ evolution-mapi-0.28.2/src/libexchangemapi/exchange-mapi-connection.h
@@ -78,12 +78,9 @@ typedef struct {
 		struct SPropValue *ext_lpProps;
 	} in; 
 
-	struct {
-		/* These are properties which would be set on the 
-		 * recipients after GetRecipientTable() */
-		uint32_t all_cValues; 
-		struct SPropValue *all_lpProps;
-	} out; 
+	/* These are properties which would be set on the 
+	 * recipients after GetRecipientTable() */
+	struct SRow out_SRow;
 } ExchangeMAPIRecipient;
 
 typedef struct {
Index: evolution-mapi-0.28.2/src/libexchangemapi/exchange-mapi-utils.c
===================================================================
--- evolution-mapi-0.28.2.orig/src/libexchangemapi/exchange-mapi-utils.c
+++ evolution-mapi-0.28.2/src/libexchangemapi/exchange-mapi-utils.c
@@ -270,8 +270,8 @@ exchange_mapi_util_free_recipient_list (
 			g_free (recipient->in.ext_lpProps);
 		if (recipient->in.req_cValues)
 			g_free (recipient->in.req_lpProps);
-/*		if (recipient->out.all_cValues)
-			g_free (recipient->out.all_lpProps);
+/*		if (recipient->out_SRow.cValues)
+			g_free (recipient->out_SRow.lpProps);
 */		g_free (recipient);
 	}
 	g_slist_free (l);
