licq-devel Mailing List for Licq

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Hi,

here is bunch of patches for the Qt4-GUI that fix session handling and
global shortcuts on KDE and make the display of remote user time less
intrusive.

ciao
  Jörg

Hi there

Please find below a link to a survey related to my PhD research work to evaluate OSS usability improvement from Industry Perspective.
It shall not not take more than 5 minutes of your precious time. 
Your identity is neither required nor recorded. The participation is highly valued and appreciated.

 http://www.kwiksurveys.com/online-survey.php?surveyID=BOHMN_8d5c35f8 
Thank you and Best Regards

Arif Raza

Hello.

Licq has a vulnerability and possible security hole. The problem is
described here http://securityvulns.ru/docs7669.html.
quoting from bugtraq

[... in  case  of  licq  there  is  no check for socket() number to be below
 FD_SETSIZE  and  it  leads  to  potentially  exploitable situation very
 similar  to  off-by-one  overflow  in  icqd-filetransfer.cpp, where one
 (easy) of few (harder) bits on the stack may be controlled by attacker,
 in this situation:

void *FileTransferManager_tep(void *arg)
{
  CFileTransferManager *ftman = (CFileTransferManager *)arg;

  fd_set f_recv, f_send;

....

    nSocketsAvailable = select(l, &f_recv, &f_send, NULL, tv);

attacker  can  partially  control  ftman  pointer (and may be even saved
ebp/eip), code execution is not something absolutely impossible.]

HOW TO REPRODUCE:
compile the attached expolit.
Run licq and discover which port is licq listening on:
lsof |grep licq |grep LISTEN
licq      29181 lmichnovic   11u     IPv4            4595400
      TCP *:24500 (LISTEN)

run compiled exploit:
./a.out 127.0.0.1 24500
(the last number is the port number)

You have to wait till approx 1020 sockets are opened and then licq
crashes (tested on licq from svn 20080410):

Licq Segmentation Violation Detected.
licq(licq_handle_sigabrt+0x2c5) [0x4b0ab5]
/lib64/libc.so.6 [0x2b58b791abd0]
/lib64/libc.so.6(gsignal+0x35) [0x2b58b791ab45]
/lib64/libc.so.6(abort+0x110) [0x2b58b791c0e0]
licq [0x4b0d4a]
/lib64/libc.so.6 [0x2b58b791abd0]
licq(_ZN10CSocketSet3SetEi+0x39) [0x4599f9]
licq(_Z18MonitorSockets_tepPv+0x506) [0x4850a6]
/lib64/libpthread.so.0 [0x2b58b6926020]
/lib64/libc.so.6(clone+0x6d) [0x2b58b79aef8d]
Attempting to generate core file.

*** glibc detected *** licq: free(): invalid pointer: 0x000000000080b790 ***
======= Backtrace: =========
/lib64/libc.so.6[0x2b58b795821d]
/lib64/libc.so.6(cfree+0x76)[0x2b58b7959f76]
licq(_ZN10CPluginLog8ClearLogEv+0x34)[0x49c174]
/usr/lib64/licq/licq_qt-gui.so(_ZN12CQtLogWindow8slot_logEi+0x95)[0x2b58b7f684c5]
/usr/lib64/licq/licq_qt-gui.so(_ZN12CQtLogWindow9qt_invokeEiP8QUObject+0x6b)[0x2b58b7f6865b]
/usr/lib/qt3/lib64/libqt-mt.so.3(_ZN7QObject15activate_signalEP15QConnectionListP8QUObject+0x14c)[0x2b58b87dfe9c]
/usr/lib/qt3/lib64/libqt-mt.so.3(_ZN7QObject15activate_signalEii+0x134)[0x2b58b87e0554]
/usr/lib/qt3/lib64/libqt-mt.so.3(_ZN15QSocketNotifier5eventEP6QEvent+0x3b)[0x2b58b87f9f7b]
/usr/lib/qt3/lib64/libqt-mt.so.3(_ZN12QApplication14internalNotifyEP7QObjectP6QEvent+0xcd)[0x2b58b878970d]
/usr/lib/qt3/lib64/libqt-mt.so.3(_ZN12QApplication6notifyEP7QObjectP6QEvent+0x98)[0x2b58b878a428]
/usr/lib/qt3/lib64/libqt-mt.so.3(_ZN10QEventLoop23activateSocketNotifiersEv+0xe3)[0x2b58b877f4d3]
/usr/lib/qt3/lib64/libqt-mt.so.3(_ZN10QEventLoop13processEventsEj+0x644)[0x2b58b873f884]
Canceled

------------------------
 Regards Ladislav.

Hi,

I am a Ph.D. student at UIUC working with Professor Ralph Johnson. My
research interest is security and software architecture. At this point, I am
surveying existing software architecture for buffer overflow vulnerability
protection.

I need some help understanding the Licq codebase. In particular I have three
questions.

1. Does the C/C++ code use the string library functions (strcpy, strcat,
gets etc)?

2. Or does it use some sort of buffer bounds checking, either by rewriting
the string library, or checking before every buffer operation?

3. Is the bounds checking available from the first release, or it has been
included in a subsequent release? How did the development team go about
making this change in the code?

Any information would be greatly appreciated. Thanks in advance.

Munawar Hafiz
UIUC
https://netfiles.uiuc.edu/mhafiz/www/

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi!

I have a friend that is using Trillian and every time I send him a
message directly and not through the sever it crashes on him.

Do you think this is a Licq problem or a Trillian problem?

/Samuel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFF2Im4xAe1JHJCWoYRAuNeAKC2ufPNIsIAD/qcegztNqLoPkDEFQCghEi4
RNdvLxhD+W9UCg5Hv+z0Uew=
=NYWQ
-----END PGP SIGNATURE-----

Hi,

I tried the OTR-patch by Martin Garbe, and it worked for me with a Gaim 
counterpart. But it didn't work with Miranda (Licq showed the 
OTR-System-Messages just as normal messages, which was really annoying).
I found out it was because of a different message-format (?) called mFormat in 
icqd-srv.cpp.
So I just copy-pasted the relevant OTR-Code. Now it works with Miranda, but it 
has only been tested for a few minutes..

I included the patch here, but the original OTR patch still has to be 
applied!!

regards,
Hagen

Am Donnerstag, 14. September 2006 18:24 schrieb Erik Johansson:
> On Thursday 14 September 2006 15:07, Christian Heimes wrote:
> > What about the gmane.org news interface? Will it still work after the
> > mailing list is moved to google?
>
> I've mailed the admin and notified him about the move, so yes, it should.

BTW: The lists have MOVED. It is official now. :)

Cheers,

Arne

=2D-=20
Dipl.-Inform. Arne Schmitz =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
Phone =C2=A0 +49 (0)241 80-21817
Computer Graphics Group =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 Fax =C2=A0 =C2=A0 +49 (0)241 80-22899
RWTH Aachen University =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0http://www.rwth-graphics.de
Ahornstrasse 55, 52074 Aachen, Germany

On Thursday 14 September 2006 15:07, Christian Heimes wrote:
> What about the gmane.org news interface? Will it still work after the
> mailing list is moved to google?

I've mailed the admin and notified him about the move, so yes, it should.

// Erik

=2D-=20
A nuclear war can ruin your whole day.

Erik Johansson
http://ejohansson.se

Erik Johansson schrieb:
> Hi all,
> 
> All Licq lists will move to Google groups (http://groups.google.com/) this 
> Friday. From that day on, all new mail should be sent to the LIST <AT> 
> googlegroups.com address (where LIST is e.g. licq-dev).
> 
> Your subscription(s) will be transfered to the new list(s), and when the move 
> is completed, you'll receive an email from Google.
> 
> If you do filtering, please update your filters. The List-Id header will be 
> <LIST.googlegroups.com> and this is probably the best way to filter.
> 
> Most lists have been renamed slightly, and the new list names can be seen 
> below:
> licq-announce
> licq-dev (previous licq-devel)
> licq-users (previous licq-main)
> licq-tickets (previous licq-bugs)
> licq-commits (previous licq-cvs)
> 
> Archive and more information about each list on 
> http://groups.google.com/group/LIST and http://trac.licq.org/wiki/MailingList

What about the gmane.org news interface? Will it still work after the
mailing list is moved to google?

Christian

Hi all,

All Licq lists will move to Google groups (http://groups.google.com/) this=
=20
=46riday. From that day on, all new mail should be sent to the LIST <AT>=20
googlegroups.com address (where LIST is e.g. licq-dev).

Your subscription(s) will be transfered to the new list(s), and when the mo=
ve=20
is completed, you'll receive an email from Google.

If you do filtering, please update your filters. The List-Id header will be=
=20
<LIST.googlegroups.com> and this is probably the best way to filter.

Most lists have been renamed slightly, and the new list names can be seen=20
below:
licq-announce
licq-dev (previous licq-devel)
licq-users (previous licq-main)
licq-tickets (previous licq-bugs)
licq-commits (previous licq-cvs)

Archive and more information about each list on=20
http://groups.google.com/group/LIST and http://trac.licq.org/wiki/MailingLi=
st

Cheers
// Erik

(This message is being cross-posted to all lists, but please keep your repl=
y=20
to one list, preferable licq-devel. Thanks!)

=2D-=20
It said Use Windows XP or better, so I installed Debian GNU/Linux.

Erik Johansson
http://ejohansson.se

On Wed, Sep 13, 2006 at 08:59:27AM +0200, Arne Schmitz wrote:
> I realised that with both protocols (Licq and MSN) active, my auto away is 
> broken. It goes auto-away, but never auto-online again. I found the 
> autoAway() in mainwin.cpp, but where on earth is the auto-online done? Can 
> someone help me out?

I just changed the code, look at my recent commits. And the code to go
auto-online is in autoAway(). It has a timer that will check what to do.

If you can't figure it out, I will play with it when I get the chance,
but it worked with ICQ and MSN when I made that commit..

Jon

MjAwNi85LzEzLCBBcm5lIFNjaG1pdHogPGFybmUuc2NobWl0ekBnbXgubmV0PjoKPiBBbSBNaXR0
d29jaCwgMTMuIFNlcHRlbWJlciAyMDA2IDE0OjA3IHNjaHJpZWIgTGFkaXNsYXYgTWljaG5vdmno
Ogo+ID4gTXkgZXhwZXJpZW5jZSB3aXRoIGxpY3EgcHJvdG9jb2wgaXMgdGhhdCBteSBzdGF0dXMg
Y2hhbmdlIGFmdGVyIGEKPiA+IHdoaWxlIG9mIGRvaW5nIG5vdGhpbmcgdG8gTkEuIEFmdGVyIEkg
c3RhcnQgdG8gdHlwZSBvciBjbGlja2luZyBtb3VzZQo+ID4gdGhlIHN0YXR1cyBjaGFuZ2UgdG8g
b25saW5lLiBTbyBpdCB3b3JrcyBJIHRoaW5rLgo+Cj4gWWVzLCBidXQgSSBvbmx5IGV4cGVyaWVu
Y2UgdGhlIG1hbGZ1bmN0aW9uIHdoZW4gdXNpbmcgYm90aCB0aGUgSUNRIGFuZCB0aGUgTVNOCj4g
cHJvdG9jb2wuIDopCgpBaGEuIFRoYXQgaXMgbm90IG15IGNhc2UuIFNvIEkgaGF2ZSBtaXN1bmRl
cnN0b29kIHRoZSBwcmV2aW91cyBtYWlsLgogUmVnYXJkcyBMYWRpc2xhdi4K

Am Mittwoch, 13. September 2006 14:07 schrieb Ladislav Michnovi=C4=8D:
> =C2=A0My experience with licq protocol is that my status change after a
> while of doing nothing to NA. After I start to type or clicking mouse
> the status change to online. So it works I think.

Yes, but I only experience the malfunction when using both the ICQ and the =
MSN=20
protocol. :)

Arne

=2D-=20
Dipl.-Inform. Arne Schmitz              Phone   +49 (0)241 80-21817
Computer Graphics Group                 Fax     +49 (0)241 80-22899
RWTH Aachen University                  http://www.rwth-graphics.de
Ahornstrasse 55, 52074 Aachen, Germany

2006/9/13, Arne Schmitz <arn...@gm...>:
> I realised that with both protocols (Licq and MSN) active, my auto away is
> broken. It goes auto-away, but never auto-online again. I found the
> autoAway() in mainwin.cpp, but where on earth is the auto-online done? Can
> someone help me out?

Hello.
 My experience with licq protocol is that my status change after a
while of doing nothing to NA. After I start to type or clicking mouse
the status change to online. So it works I think. The only thing which
annoys me is that my previous status was Away and it always turns to
online. This is I think logical and intended, but it annoys me little
bit.
 Regards Ladislav.

I realised that with both protocols (Licq and MSN) active, my auto away is=
=20
broken. It goes auto-away, but never auto-online again. I found the=20
autoAway() in mainwin.cpp, but where on earth is the auto-online done? Can=
=20
someone help me out?

Arne

=2D-=20
Dipl.-Inform. Arne Schmitz =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
Phone =C2=A0 +49 (0)241 80-21817
Computer Graphics Group =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 Fax =C2=A0 =C2=A0 +49 (0)241 80-22899
RWTH Aachen University =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0http://www.rwth-graphics.de
Ahornstrasse 55, 52074 Aachen, Germany

Am Montag, 11. September 2006 16:23 schrieb Jon Keating:
> On 9/11/06, Arne Schmitz <arn...@gm...> wrote:
> > 10:05:05: [MSN] Server found at 65.54.239.140:1863.
> > 10:05:06: [MSN] Server found at 207.46.4.22:1863.
> >
> > Should the msn plugin switch to this other server, if the first one
> > fails?
>
> It should be switching before it fails. Can you send the packet dumps?

Sent it to you via PM.

Arne

=2D-=20
Dipl.-Inform. Arne Schmitz              Phone   +49 (0)241 80-21817
Computer Graphics Group                 Fax     +49 (0)241 80-22899
RWTH Aachen University                  http://www.rwth-graphics.de
Ahornstrasse 55, 52074 Aachen, Germany

On 9/11/06, Arne Schmitz <arn...@gm...> wrote:
> 10:05:05: [MSN] Server found at 65.54.239.140:1863.
> 10:05:06: [MSN] Server found at 207.46.4.22:1863.
>
> Should the msn plugin switch to this other server, if the first one fails?

It should be switching before it fails. Can you send the packet dumps?

Jon

________________________________________________________
Jon Keating                ICQ: 16325723
jo...@li...               MSN: kea...@ho...
http://www.licq.org        GPG: 2290A71F
http://www.thejon.org      HOME: Minamiashigara, Japan

Am Samstag, 9. September 2006 14:45 schrieb Jon Keating:
> If you are still getting fake offlines, please send an authorization
> request to the user, or ask them to authorize you directly. It appears
> to only come from users that are on the "Waiting Authorization" list.
> Licq does not show this group seperately, like the official client does,
> but it does maintain it internally somewhat.

Can we get Licq to show this list to the user, i.e. can we query this list=
=20
from the server? That would be neat. For example I am using Licq on differe=
nt=20
computers. So an internal storage of this list would be of no use.

Arne

=2D-=20
Dipl.-Inform. Arne Schmitz              Phone   +49 (0)241 80-21817
Computer Graphics Group                 Fax     +49 (0)241 80-22899
RWTH Aachen University                  http://www.rwth-graphics.de
Ahornstrasse 55, 52074 Aachen, Germany

I am currently having problems logging onto msn. The server returns a 601=20
error, which is not handled by the msn plugin yet. According to [1] this=20
means "server not available". In the network protocol I can see that the ms=
n=20
plugin finds another server at another IP address:

10:05:05: [MSN] Server found at 65.54.239.140:1863.
10:05:06: [MSN] Server found at 207.46.4.22:1863.

Should the msn plugin switch to this other server, if the first one fails?

Arne

[1] http://www.hypothetic.org/docs/msn/reference/error_list.php

=2D-=20
Dipl.-Inform. Arne Schmitz              Phone   +49 (0)241 80-21817
Computer Graphics Group                 Fax     +49 (0)241 80-22899
RWTH Aachen University                  http://www.rwth-graphics.de
Ahornstrasse 55, 52074 Aachen, Germany

c2VlIGFib3ZlCgotLSAKRGlwbC4tSW5mb3JtLiBBcm5lIFNjaG1pdHogwqAgwqAgwqAgwqAgwqAg
wqAgwqBQaG9uZSDCoCArNDkgKDApMjQxIDgwLTIxODE3CkNvbXB1dGVyIEdyYXBoaWNzIEdyb3Vw
IMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIEZheCDCoCDCoCArNDkgKDApMjQxIDgwLTIyODk5ClJX
VEggQWFjaGVuIFVuaXZlcnNpdHkgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBodHRwOi8vd3d3
LnJ3dGgtZ3JhcGhpY3MuZGUKQWhvcm5zdHJhc3NlIDU1LCA1MjA3NCBBYWNoZW4sIEdlcm1hbnkK

If you are still getting fake offlines, please send an authorization
request to the user, or ask them to authorize you directly. It appears
to only come from users that are on the "Waiting Authorization" list.
Licq does not show this group seperately, like the official client does,
but it does maintain it internally somewhat.

On a side note, the authorization part of the protocol has changed it
seems. If you get authorized, it comes as unknown packets. I'll work on
this before RC2.

Jon

I've made a new "Date Format" option in "Message Display" option tab.
This option allows user to set own Date Format in Messages (like Style
and Colors). There are few predefined date formats available but also a
"Custom Date Format" option exists which allows to set own datetime
format ("WhatsThis?" help is available and describes available variables
for set).
Localization has not been made yet (And I think I just can't do this).

http://trac.licq.org/ticket/1389 for more info and patch files.

Any comments/tests are welcome.

-- 
Later

Am Mittwoch, 6. September 2006 09:50 schrieb Arne Schmitz:
> Yes, the signature to the former mail is broken. This seems to be a sf.net
> problem, I am working this out with sf.net staff. So with this correctly
> signed email I assure you that the former email is also valid and genuine=
ly
>
> >from me. :)
>
> Arne

Oh dear, fooled myself again. :)

Arne

=2D-=20
Dipl.-Inform. Arne Schmitz              Phone   +49 (0)241 80-21817
Computer Graphics Group                 Fax     +49 (0)241 80-22899
RWTH Aachen University                  http://www.rwth-graphics.de
Ahornstrasse 55, 52074 Aachen, Germany

Yes, the signature to the former mail is broken. This seems to be a sf.net=
=20
problem, I am working this out with sf.net staff. So with this correctly=20
signed email I assure you that the former email is also valid and genuinely=
=20
from me. :)

Arne

=2D-=20
Dipl.-Inform. Arne Schmitz              Phone   +49 (0)241 80-21817
Computer Graphics Group                 Fax     +49 (0)241 80-22899
RWTH Aachen University                  http://www.rwth-graphics.de
Ahornstrasse 55, 52074 Aachen, Germany

On Mon, Sep 04, 2006 at 08:07:32PM +0200, Erik Johansson wrote:
> RC1. It wont be visible on licq.org until Jon wakes up and does a svn up, but 
> it can be viewed on se.licq.org for now.

Just a quick note... I updated the website. And, I can't use SVN on the
sourceforge.net server. They have some strict firewall rules, especially
for outgoing traffic.

I'll reply to this e-mail tonight.. have been a bit busy with my job.

Jon

1999	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec (379)
2000	Jan (449)	Feb (381)	Mar (308)	Apr (410)	May (198)	Jun (381)	Jul (164)	Aug (109)	Sep (108)	Oct (152)	Nov (66)	Dec (137)
2001	Jan (111)	Feb (51)	Mar (87)	Apr (17)	May (22)	Jun (45)	Jul (50)	Aug (72)	Sep (20)	Oct (73)	Nov (374)	Dec (236)
2002	Jan (221)	Feb (157)	Mar (152)	Apr (89)	May (180)	Jun (105)	Jul (170)	Aug (215)	Sep (145)	Oct (179)	Nov (148)	Dec (107)
2003	Jan (183)	Feb (219)	Mar (137)	Apr (172)	May (167)	Jun (105)	Jul (143)	Aug (38)	Sep (39)	Oct (54)	Nov (40)	Dec (38)
2004	Jan (90)	Feb (36)	Mar (43)	Apr (18)	May (46)	Jun (36)	Jul (11)	Aug (109)	Sep (28)	Oct (43)	Nov (24)	Dec (32)
2005	Jan (48)	Feb (39)	Mar (101)	Apr (81)	May (68)	Jun (29)	Jul (26)	Aug (88)	Sep (84)	Oct (99)	Nov (66)	Dec (74)
2006	Jan (28)	Feb (23)	Mar (28)	Apr (64)	May (73)	Jun (43)	Jul (23)	Aug (69)	Sep (25)	Oct (1)	Nov	Dec
2007	Jan	Feb (1)	Mar	Apr (1)	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec
2008	Jan	Feb	Mar	Apr (1)	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec
2010	Jan	Feb (1)	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec
2011	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov (1)	Dec