mirrors/ngircd
1
0
Fork 0
mirror of https://github.com/osmarks/ngircd.git synced 2025-02-04 11:29:10 +00:00
Code Issues Releases Wiki Activity

Don't use Client_Type after command has been processed.

Browse Source 
This caused a read from already free'd memory, if the processed
command (IRC_QUIT) calls Client_Destroy.
This commit is contained in:
Florian Westphal 2008-02-05 13:07:14 +00:00
parent f86ce17f1c
commit 3022d7cff3
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/ngircd/parse.c
View File

@ -12,7 +12,7 @@
#include "portab.h" #include "portab.h"
static char UNUSED id[] = "$Id: parse.c,v 1.70 2008/01/13 16:12:49 fw Exp $"; static char UNUSED id[] = "$Id: parse.c,v 1.71 2008/02/05 13:07:14 fw Exp $";
/** /**
* @file * @file
@ -421,6 +421,7 @@ Handle_Request( CONN_ID Idx, REQUEST *Req )
* wird die Verbindung geschlossen und false geliefert. */ * wird die Verbindung geschlossen und false geliefert. */
CLIENT *client; CLIENT *client;
bool result = true; bool result = true;
int client_type;
COMMAND *cmd; COMMAND *cmd;
assert( Idx >= 0 ); assert( Idx >= 0 );
@ -431,8 +432,9 @@ Handle_Request( CONN_ID Idx, REQUEST *Req )
assert( client != NULL ); assert( client != NULL );
/* Numeric? */ /* Numeric? */
if ((Client_Type(client) == CLIENT_SERVER || client_type = Client_Type(client);
Client_Type(client) == CLIENT_UNKNOWNSERVER) if ((client_type == CLIENT_SERVER ||
client_type == CLIENT_UNKNOWNSERVER)
&& strlen(Req->command) == 3 && atoi(Req->command) > 1) && strlen(Req->command) == 3 && atoi(Req->command) > 1)
return Handle_Numeric(client, Req); return Handle_Numeric(client, Req);
@ -444,7 +446,7 @@ Handle_Request( CONN_ID Idx, REQUEST *Req )
continue; continue;
} }
if (!(Client_Type(client) & cmd->type)) if (!(client_type & cmd->type))
return IRC_WriteStrClient(client, ERR_NOTREGISTERED_MSG, Client_ID(client)); return IRC_WriteStrClient(client, ERR_NOTREGISTERED_MSG, Client_ID(client));
/* Command is allowed for this client: call it and count produced bytes */ /* Command is allowed for this client: call it and count produced bytes */
@ -453,16 +455,16 @@ Handle_Request( CONN_ID Idx, REQUEST *Req )
cmd->bytes += Conn_WCounter(); cmd->bytes += Conn_WCounter();
/* Adjust counters */ /* Adjust counters */
if (Client_Type(client) != CLIENT_SERVER) if (client_type != CLIENT_SERVER)
cmd->lcount++; cmd->lcount++;
else else
cmd->rcount++; cmd->rcount++;
return result; return result;
} }
if (Client_Type( client ) != CLIENT_USER && if (client_type != CLIENT_USER &&
Client_Type( client ) != CLIENT_SERVER && client_type != CLIENT_SERVER &&
Client_Type( client ) != CLIENT_SERVICE ) client_type != CLIENT_SERVICE )
return true; return true;
/* Unknown command and registered connection: generate error: */ /* Unknown command and registered connection: generate error: */