albino
/
ngircd-tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Don't access already freed memory in IRC_KILL() 

It is not possible to call Conn_Close() after Client_Destroy() has been
called, because Conn_Close wants to access the CLIENT structure which
then has been freed already.

Fix IRC_KILL to use Conn_Close() for local clients and Client_Destroy()
for remote clients only (and never both).
This commit is contained in:
Alexander Barton 2010-05-22 17:03:54 +02:00
parent 6dc80bd195
commit 55190f2d3d
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/ngircd/irc.c
View File

@ -160,11 +160,15 @@ IRC_KILL( CLIENT *Client, REQUEST *Req )
Client_Type( c ), Req->argv[0] );
}
/* Kill client NOW! */
/* Kill the client NOW:
* - Close the local connection (if there is one),
* - Destroy the CLIENT structure for remote clients.
* Note: Conn_Close() removes the CLIENT structure as well. */
conn = Client_Conn( c );
Client_Destroy( c, NULL, reason, false );
if( conn > NONE )
Conn_Close( conn, NULL, reason, true );
if(conn > NONE)
Conn_Close(conn, NULL, reason, true);
else
Client_Destroy(c, NULL, reason, false);
}
else
Log( LOG_NOTICE, "Client with nick \"%s\" is unknown here.", Req->argv[0] );