From 26c65a11cf06209b2cb5121eda286b5fa8148b89 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Mon, 7 Jan 2008 11:41:43 +0000 Subject: [PATCH] IRC_PART could reference invalid memory. --- ChangeLog | 6 +++++- src/ngircd/irc-channel.c | 6 ++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 2b9a6e85..f89ad8e2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -9,6 +9,10 @@ -- ChangeLog -- +ngIRCd 0.10.4 (2008-01-07) + + - SECURITY: IRC_PART could reference invalid memory, causing + ngircd to crash. ngIRCd 0.10.3 (2007-07-31) @@ -694,4 +698,4 @@ ngIRCd 0.0.1, 31.12.2001 -- -$Id: ChangeLog,v 1.302.2.19 2007/07/31 19:33:51 alex Exp $ +$Id: ChangeLog,v 1.302.2.20 2008/01/07 11:41:43 fw Exp $ diff --git a/src/ngircd/irc-channel.c b/src/ngircd/irc-channel.c index e59f32fa..99df1dcb 100644 --- a/src/ngircd/irc-channel.c +++ b/src/ngircd/irc-channel.c @@ -14,7 +14,7 @@ #include "portab.h" -static char UNUSED id[] = "$Id: irc-channel.c,v 1.35.2.4 2007/07/31 18:54:30 alex Exp $"; +static char UNUSED id[] = "$Id: irc-channel.c,v 1.35.2.5 2008/01/07 11:41:44 fw Exp $"; #include "imp.h" #include @@ -270,7 +270,9 @@ IRC_PART( CLIENT *Client, REQUEST *Req ) assert( Req != NULL ); /* Falsche Anzahl Parameter? */ - if(( Req->argc > 2 )) return IRC_WriteStrClient( Client, ERR_NEEDMOREPARAMS_MSG, Client_ID( Client ), Req->command ); + if (Req->argc < 1 || Req->argc > 2) + return IRC_WriteStrClient(Client, ERR_NEEDMOREPARAMS_MSG, + Client_ID(Client), Req->command); /* Wer ist der Absender? */ if( Client_Type( Client ) == CLIENT_SERVER ) target = Client_Search( Req->prefix );