From 44343a5c376a75049625c53c4db9e8d51ca8ff8d Mon Sep 17 00:00:00 2001
From: Michael Vetter <jubalh@iodoru.org>
Date: Thu, 25 Mar 2021 16:34:20 +0100
Subject: [PATCH] avatar: make _avatar_metadata_handler safer

---
 src/xmpp/avatar.c | 31 ++++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/src/xmpp/avatar.c b/src/xmpp/avatar.c
index bf937872..1bbda806 100644
--- a/src/xmpp/avatar.c
+++ b/src/xmpp/avatar.c
@@ -113,6 +113,9 @@ static int
 _avatar_metadata_handler(xmpp_stanza_t* const stanza, void* const userdata)
 {
     const char* from = xmpp_stanza_get_attribute(stanza, STANZA_ATTR_FROM);
+    if (!from) {
+        return 1;
+    }
 
     if (!g_hash_table_contains(looking_for, from)) {
         return 1;
@@ -141,22 +144,28 @@ _avatar_metadata_handler(xmpp_stanza_t* const stanza, void* const userdata)
     xmpp_stanza_t* item = xmpp_stanza_get_child_by_name(items, "item");
     if (item) {
         xmpp_stanza_t* metadata = xmpp_stanza_get_child_by_name(item, "metadata");
-        if (!metadata)
-            return 1;
+        if (metadata) {
 
-        xmpp_stanza_t* info = xmpp_stanza_get_child_by_name(metadata, "info");
+            xmpp_stanza_t* info = xmpp_stanza_get_child_by_name(metadata, "info");
+            if (info) {
 
-        const char* id = xmpp_stanza_get_id(info);
-        const char* type = xmpp_stanza_get_attribute(info, "type");
+                const char* id = xmpp_stanza_get_id(info);
+                const char* type = xmpp_stanza_get_attribute(info, "type");
 
-        log_debug("Avatar ID for %s is: %s", from, id);
+                if(id && type) {
+                    log_debug("Avatar ID for %s is: %s", from, id);
 
-        avatar_metadata* data = malloc(sizeof(avatar_metadata));
-        data->type = strdup(type);
-        data->id = strdup(id);
+                    avatar_metadata* data = malloc(sizeof(avatar_metadata));
+                    if(data) {
+                        data->type = strdup(type);
+                        data->id = strdup(id);
 
-        // request the actual (image) data
-        _avatar_request_item_by_id(from, data);
+                        // request the actual (image) data
+                        _avatar_request_item_by_id(from, data);
+                    }
+                }
+            }
+        }
     }
 
     return 1;