Bug #726788 - Crash on malformed vCard

If the vcard is "END:VCARD" then the attribute is added to
the list, then freed. So next time we iterate on attributes it
will read freed memory and crash.

diff --git a/addressbook/libebook-contacts/e-vcard.c b/addressbook/libebook-contacts/e-vcard.c
index cba32b8..cf2358c 100644 (file)
--- a/addressbook/libebook-contacts/e-vcard.c
+++ b/addressbook/libebook-contacts/e-vcard.c
@@ -763,7 +763,8 @@ parse (EVCard *evc,
                e_vcard_attribute_free (attr);
                attr = NULL;
        } else if (attr) {
-               if (!ignore_uid || g_ascii_strcasecmp (attr->name, EVC_UID) != 0)
+               if ((!ignore_uid || g_ascii_strcasecmp (attr->name, EVC_UID) != 0) &&
+                   g_ascii_strcasecmp (attr->name, "end") != 0)
                        e_vcard_add_attribute (evc, attr);
        }
        while (*p) {