Index: pidgin-2.7.3/libpurple/util.c
===================================================================
--- pidgin-2.7.3.orig/libpurple/util.c	2010-08-10 09:35:49.000000000 +0200
+++ pidgin-2.7.3/libpurple/util.c	2014-03-14 17:13:31.206897505 +0100
@@ -33,6 +33,8 @@
 #include "prefs.h"
 #include "util.h"
 
+#define MAX_HTTP_CHUNK_SIZE (10 * 1024 * 1024)
+
 struct _PurpleUtilFetchUrlData
 {
 	PurpleUtilFetchUrlCallback callback;
@@ -3728,11 +3730,12 @@ process_chunked_data(char *data, gsize *
 			break;
 		s += 2;
 
-		if (s + sz > data + *len) {
+		if (sz > MAX_HTTP_CHUNK_SIZE || s + sz > data + *len) {
 			purple_debug_error("util", "Error processing chunked data: "
 					"Chunk size %" G_GSIZE_FORMAT " bytes was longer "
 					"than the data remaining in the buffer (%"
 					G_GSIZE_FORMAT " bytes)\n", sz, data + *len - s);
+			break;
 		}
 
 		/* Move all data overtop of the chunk length that we read in earlier */
@@ -3740,7 +3743,7 @@ process_chunked_data(char *data, gsize *
 		p += sz;
 		s += sz;
 		newlen += sz;
-		if (*s != '\r' && *(s + 1) != '\n') {
+		if (*s == '\0' || (*s != '\r' && *(s + 1) != '\n')) {
 			purple_debug_error("util", "Error processing chunked data: "
 					"Expected \\r\\n, found: %s\n", s);
 			break;
