1 files changed, 5 insertions, 1 deletions
diff --git a/Swiften/Avatars/VCardUpdateAvatarManager.cpp b/Swiften/Avatars/VCardUpdateAvatarManager.cpp
index 3e8d87b..349af2f 100644
--- a/Swiften/Avatars/VCardUpdateAvatarManager.cpp
+++ b/Swiften/Avatars/VCardUpdateAvatarManager.cpp
@@ -1,11 +1,11 @@
 /*
- * Copyright (c) 2010-2016 Isode Limited.
+ * Copyright (c) 2010-2018 Isode Limited.
  * All rights reserved.
  * See the COPYING file for more information.
  */
 
 #include <Swiften/Avatars/VCardUpdateAvatarManager.h>
 
 #include <boost/bind.hpp>
 
 #include <Swiften/Avatars/AvatarStorage.h>
@@ -26,18 +26,22 @@ VCardUpdateAvatarManager::VCardUpdateAvatarManager(VCardManager* vcardManager, S
     vcardManager_->onVCardChanged.connect(boost::bind(&VCardUpdateAvatarManager::handleVCardChanged, this, _1, _2));
 }
 
 void VCardUpdateAvatarManager::handlePresenceReceived(std::shared_ptr<Presence> presence) {
     std::shared_ptr<VCardUpdate> update = presence->getPayload<VCardUpdate>();
     if (!update || presence->getPayload<ErrorPayload>()) {
         return;
     }
     JID from = getAvatarJID(presence->getFrom());
+    if (update->getPhotoHash().size() != 40) {
+        SWIFT_LOG(debug) << "Invalid vCard avatar photo hash length. Must be hex-encoded SHA-1, i.e. 40 characters." << std::endl;
+        return;
+    }
     if (getAvatarHash(from) == update->getPhotoHash()) {
         return;
     }
     SWIFT_LOG(debug) << "Updated hash: " << from << " -> " << update->getPhotoHash() << std::endl;
     if (avatarStorage_->hasAvatar(update->getPhotoHash())) {
         setAvatarHash(from, update->getPhotoHash());
     }
     else {
         vcardManager_->requestVCard(from);