From 912ba614897ad584ab6051cd3f9f9db51970be8d Mon Sep 17 00:00:00 2001
From: Polynomdivision <papatutuwawa@polynom.me>
Date: Fri, 29 Oct 2021 15:14:15 +0000
Subject: [PATCH] Prevent crash in avatar code (#133)

* Prevent crash on empty urn:xmpp:avatar:* nodes

* Fix issue with errors

* Add a test for empty avatar pubsub items
---
 xmpp.go      | 12 ++++++++++++
 xmpp_test.go | 24 ++++++++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/xmpp.go b/xmpp.go
index b13564a..2b180e2 100644
--- a/xmpp.go
+++ b/xmpp.go
@@ -653,6 +653,10 @@ func (c *Client) Recv() (stanza interface{}, err error) {
 				// Handle Pubsub notifications
 				switch v.Event.Items.Node {
 				case XMPPNS_AVATAR_PEP_METADATA:
+					if len(v.Event.Items.Items) == 0 {
+						return AvatarMetadata{}, errors.New("No avatar metadata items available")
+					}
+
 					return handleAvatarMetadata(v.Event.Items.Items[0].Body,
 						v.From)
 				// I am not sure whether this can even happen.
@@ -765,10 +769,18 @@ func (c *Client) Recv() (stanza interface{}, err error) {
 
 					switch p.Node {
 					case XMPPNS_AVATAR_PEP_DATA:
+						if len(p.Items) == 0 {
+							return AvatarData{}, errors.New("No avatar data items available")
+						}
+
 						return handleAvatarData(p.Items[0].Body,
 							v.From,
 							p.Items[0].ID)
 					case XMPPNS_AVATAR_PEP_METADATA:
+						if len(p.Items) == 0 {
+							return AvatarMetadata{}, errors.New("No avatar metadata items available")
+						}
+
 						return handleAvatarMetadata(p.Items[0].Body,
 							v.From)
 					default:
diff --git a/xmpp_test.go b/xmpp_test.go
index 3496d4e..2966d98 100644
--- a/xmpp_test.go
+++ b/xmpp_test.go
@@ -114,3 +114,27 @@ func TestEOFError(t *testing.T) {
 		t.Errorf("Recv() did not return io.EOF on end of input stream")
 	}
 }
+
+var emptyPubSub = strings.TrimSpace(`
+<iq xmlns="jabber:client" type='result' from='juliet@capulet.lit' id='items3'>
+  <pubsub xmlns='http://jabber.org/protocol/pubsub'>
+    <items node='urn:xmpp:avatar:data'></items>
+  </pubsub>
+</iq>
+`)
+func TestEmptyPubsub(t *testing.T) {
+	var c Client
+	c.conn = tConnect(emptyPubSub)
+	c.p = xml.NewDecoder(c.conn)
+	m, err := c.Recv()
+	
+	switch m.(type) {
+	case AvatarData:
+		if err == nil {
+			t.Errorf("Expected an error to be returned")
+		}
+	default:
+		t.Errorf("Recv() = %v", m)
+		t.Errorf("Expected a return value of AvatarData")
+	}
+}